项目本身是不是无法左ret2text的啊

[star1313]

 ____                 ____            _  
   |  _ \ __      ___ _|  _ \ __ _ ___(_)   
   | |_) |\ \ /\ / / '_ \ |_) / _` / __| |  
   |  __/  \ V  V /| | | |  __/ (_| \__ \ | 
   |_|      \_/\_/ |_| |_|_|   \__,_|___/_| 

Automated Binary Exploitation Framework v3.1
by Security Research Team
https://github.com/heimao-box/pwnpasi

[] [11:20:52] target binary: ./task_base
[] [11:20:52] local exploitation mode
[*] [11:20:52] detecting libc path automatically
[!] [11:20:52] libc path not found in ldd output

┌────────────────────────────────────────────────────────────┐
│ BINARY ANALYSIS PHASE │
└────────────────────────────────────────────────────────────┘
[] [11:20:52] setting executable permissions
[] [11:20:52] collecting binary security information
[*] [11:20:52] collecting binary information

┌────────────────────────────────────────────────────────────┐
│ BINARY SECURITY ANALYSIS │
└────────────────────────────────────────────────────────────┘
Feature | Status | Risk Level

 RELRO      |  Partial RELRO  |     MEDIUM     

Stack Canary | No canary found | HIGH
NX Bit | NX enabled | LOW
PIE | No PIE (0x3ff000) | MEDIUM
RWX Segments | Unknown | LOW

┌────────────────────────────────────────────────────────────┐
│ FUNCTION ANALYSIS │
└────────────────────────────────────────────────────────────┘
[] [11:20:54] scanning PLT functions
[] [11:20:54] analyzing PLT table and available functions

┌────────────────────────────────────────────────────────────┐
│ FUNCTION ANALYSIS │
└────────────────────────────────────────────────────────────┘
Function | Address | Available

 write      |       N/A       |       NO       
 puts       | 0000000000401080 |       YES      
printf      | 00000000004010b0 |       YES      
 main       | 000000000040128c |       YES      
system      | 00000000004010a0 |       YES      

backdoor | 0000000000401201 | YES
callsystem | N/A | NO
[*] [11:20:54]

┌────────────────────────────────────────────────────────────┐
│ ROP GADGET DISCOVERY │
└────────────────────────────────────────────────────────────┘
[] [11:20:54] searching for x64 ROP gadgets
[] [11:20:54] searching for ROP gadgets (x64)

┌────────────────────────────────────────────────────────────┐
│ ROP GADGETS (x64) │
└────────────────────────────────────────────────────────────┘
Gadget Type | Address | Instruction

  ret       | 0x000000000040101a |       ret

[*] [11:20:55]

┌────────────────────────────────────────────────────────────┐
│ PADDING CALCULATION │
└────────────────────────────────────────────────────────────┘
[] [11:20:55] performing dynamic stack overflow testing
[] [11:20:55] testing for stack overflow vulnerability

┌────────────────────────────────────────────────────────────┐
│ STACK OVERFLOW DETECTION │
└────────────────────────────────────────────────────────────┘
[] Testing overflow: [██████████████████████████████] 100%[] [11:20:56]
[+] [11:20:56] stack overflow detected! Padding: 128 bytes
[*] [11:20:56] performing assembly-based overflow analysis
[+] [11:20:56] stack size: 112 bytes
[+] [11:20:56] overflow padding adjustment: 120 bytes

┌────────────────────────────────────────────────────────────┐
│ VULNERABLE FUNCTIONS IDENTIFIED │
└────────────────────────────────────────────────────────────┘
[+] [11:20:56] vulnerable function: vuln

┌────────────────────────────────────────────────────────────┐
│ ASSEMBLY CODE ANALYSIS │
└────────────────────────────────────────────────────────────┘
[*] [11:20:56] disassembling function: vuln
0000000000401220 :
401220: endbr64
401224: push rbp
401225: mov rbp,rsp
401228: sub rsp,0x70
40122c: mov DWORD PTR [rbp-0x4],0x0
401233: jmp 40127c <vuln+0x5c>
401235: lea rax,[rip+0xdd0] # 40200c <_IO_stdin_used+0xc>
40123c: mov rdi,rax
40123f: mov eax,0x0
401244: call 4010b0 printf@plt
401249: lea rax,[rbp-0x70]
40124d: mov edx,0x190
401252: mov rsi,rax
401255: mov edi,0x0
40125a: mov eax,0x0
40125f: call 4010c0 read@plt
401264: movzx eax,BYTE PTR [rbp-0x70]
401268: cmp al,0xa
40126a: je 401284 <vuln+0x64>
40126c: lea rax,[rbp-0x70]
401270: mov rdi,rax
401273: call 401080 puts@plt
401278: add DWORD PTR [rbp-0x4],0x1
40127c: cmp DWORD PTR [rbp-0x4],0x63
401280: jle 401235 <vuln+0x15>
401282: jmp 401285 <vuln+0x65>
401284: nop
401285: mov eax,0x0
40128a: leave
40128b: ret

000000000040128c

:
40128c: endbr64
401290: push rbp
401291: mov rbp,rsp
401294: mov eax,0x0
401299: call 4011b6
40129e: mov eax,0x0
4012a3: call 401220
4012a8: lea rax,[rip+0xd64] # 402013 <_IO_stdin_used+0x13>
4012af: mov rdi,rax
4012b2: call 401080 puts@plt
4012b7: mov eax,0x0
4012bc: pop rbp
4012bd: ret

Disassembly of section .fini:

00000000004012c0 <_fini>:
4012c0: endbr64
4012c4: sub rsp,0x8
4012c8: add rsp,0x8
4012cc: ret

┌────────────────────────────────────────────────────────────┐
│ STRING ANALYSIS │
└────────────────────────────────────────────────────────────┘
[] [11:20:56] searching for /bin/sh string in binary
[] [11:20:56] checking for /bin/sh string
[+] [11:20:56] /bin/sh string found in binary
[*] [11:20:56] testing for stack overflow vulnerability

┌────────────────────────────────────────────────────────────┐
│ STACK OVERFLOW DETECTION │
└────────────────────────────────────────────────────────────┘
[] Testing overflow: [██████████████████████████████] 100%[] [11:20:57]
[+] [11:20:57] stack overflow detected! Padding: 128 bytes
[*] [11:20:57] performing assembly-based overflow analysis
[+] [11:20:57] stack size: 112 bytes
[+] [11:20:57] overflow padding adjustment: 120 bytes

┌────────────────────────────────────────────────────────────┐
│ EXPLOITATION PHASE │
└────────────────────────────────────────────────────────────┘
[*] [11:20:57] initializing exploitation attempts

┌────────────────────────────────────────────────────────────┐
│ LOCAL STACK OVERFLOW EXPLOITATION │
└────────────────────────────────────────────────────────────┘
[*] [11:20:57] executing local stack overflow exploitation

┌────────────────────────────────────────────────────────────┐
│ EXPLOITATION: ret2system - x64 │
└────────────────────────────────────────────────────────────┘
[PAYLOAD] [11:20:57] preparing ret2system exploit
[-] [11:20:57] pop rdi gadget not found, exploitation not possible

/bin/sh，system， backdoor，栈溢出都找到了，不用 ret2system，pop rdi就可以做题了