0xc0 国际惯例，先上exp

#!/usr/bin/env python
from pwn import *
context(os='linux', arch='amd64')


r=remote('182.92.203.154',11001) 
r.sendline()
r.recvuntil('start.')
from typing import *


maze = (r.recvuntil('\n>',drop=True).decode())

def find_path(maze: str) -> str:
    way = []
    maze_list = maze.split('\n')
    maze_height = len(maze_list)
    maze_width = len(maze_list[0])
    passed = [[0 for _ in range(maze_width)] for _ in range(maze_height)]

    def maze_helper(pos: Tuple[int, int]) -> bool:
        x, y = pos
        passed[y][x] = 1
        if maze_list[y][x] == '$':
            return True
        for i in 'adws':
            if i == 'a' and x > 0 and maze_list[y][x - 1] != '#' and passed[y][x - 1] != 1:
                way.append(i)
                if not maze_helper((x - 1, y)):
                    way.pop()
                else:
                    return True
            elif i == 'd' and x < maze_width - 1 and maze_list[y][x + 1] != '#' and passed[y][x + 1] != 1:
                way.append(i)
                if not maze_helper((x + 1, y)):
                    way.pop()
                else:
                    return True
            elif i == 'w' and y > 0 and maze_list[y - 1][x] != '#' and passed[y - 1][x] != 1:
                way.append(i)
                if not maze_helper((x, y - 1)):
                    way.pop()
                else:
                    return True
            elif i == 's' and y < maze_height - 1 and maze_list[y + 1][x] != '#' and passed[y + 1][x] != 1:
                way.append(i)
                if not maze_helper((x, y + 1)):
                    way.pop()
                else:
                    return True
        else:
            return False

    x, y = 0, 0
    for i, line in enumerate(maze_list):
        for j, value in enumerate(line):
            if value == '*':
                x, y = j, i
                break
        else:
            continue
        break
    maze_helper((x, y))
    return ''.join(way)

r.sendline(find_path(maze))
r.recvuntil('your win\n')

maze = (r.recvuntil('\n>',drop=True).decode())
r.sendline(find_path(maze))
r.recvuntil('your win\n')

maze = (r.recvuntil('\n>',drop=True).decode())
r.sendline(find_path(maze))
r.recvuntil('your win\n')

maze = (r.recvuntil('\n>',drop=True).decode())
r.sendline(find_path(maze))
r.recvuntil('your win\n')

maze = (r.recvuntil('\n>',drop=True).decode())
r.sendline(find_path(maze))
r.recvuntil('your win\n')

print(r.recvuntil('}',drop=False).decode())

四个迷宫，梭就完事了