from pwn import *
from ctypes import *
import time
import sys

def generate_random_number():
    LIBC_CODE.srand(int(time.time()))
    rand_number  = LIBC_CODE.rand()
    rand_number |= LIBC_CODE.rand() << 32
    return rand_number

# Input remote exploit
IP      = ''
PORT    = ''
BIN     = ''
local   = False

context.binary = BIN
context.log_level = 'debug'

#LIBC functions
LIBC = ELF('')
LIBC_CODE = CDLL("")
ENV = {"LD_PRELOAD": LIBC} if LIBC else {}
system_libc_offset = LIBC.symbols['system']
log.info("system function at offset {:#x} in libc".format(system_libc_offset))
puts_libc_offset = LIBC.symbols['puts']
log.info("puts function at offset {:#x} in libc".format(puts_libc_offset))
bin_sh_offset = next(LIBC.search(b'/bin/sh'))
log.info("bin_sh at offset {:#x} in libc".format(bin_sh_offset))

# Address from the binary 
ELF_LOADED = ELF(BIN)
ROP_LOADED = ROP(ELF_LOADED)
pop_rdi_ret = (ROP_LOADED.find_gadget(['pop rdi', 'ret']))[0]
main_address = 
puts_plt = ELF_LOADED.plt['puts']
puts_got = ELF_LOADED.got['puts']

if not local:
    io = remote(IP, PORT)
else:
    io = process(BIN)
#    io = gdb.debug(BIN, 'b main')

# Stage 1

# Stage 2

# Stage 3

io.interactive()

from pwn import *
from ctypes import *
import time
import sys

def generate_random_number():
    LIBC_CODE.srand(int(time.time()))
    rand_number  = LIBC_CODE.rand()
    rand_number |= LIBC_CODE.rand() << 32
    return rand_number

# Input remote exploit
IP      = ''
PORT    = ''
BIN     = ''
local   = False

context.binary = BIN
context.log_level = 'debug'

#LIBC functions
LIBC = ELF('')
LIBC_CODE = CDLL("")
ENV = {"LD_PRELOAD": LIBC} if LIBC else {}
system_libc_offset = LIBC.symbols['system']
log.info("system function at offset {:#x} in libc".format(system_libc_offset))
puts_libc_offset = LIBC.symbols['puts']
log.info("puts function at offset {:#x} in libc".format(puts_libc_offset))
bin_sh_offset = next(LIBC.search(b'/bin/sh'))
log.info("bin_sh at offset {:#x} in libc".format(bin_sh_offset))

# Address from the binary 
ELF_LOADED = ELF(BIN)
ROP_LOADED = ROP(ELF_LOADED)
pop_rdi_ret = (ROP_LOADED.find_gadget(['pop rdi', 'ret']))[0]
main_address = 
puts_plt = ELF_LOADED.plt['puts']
puts_got = ELF_LOADED.got['puts']

if not local:
    io = remote(IP, PORT)
else:
    io = process(BIN)
#    io = gdb.debug(BIN, 'b main')

# Stage 1

# Stage 2

# Stage 3

io.interactive()

# Input remote exploit #LIBC functions #x} in libc".format(system_libc_offset)) #x} in libc".format(puts_libc_offset)) #x} in libc".format(bin_sh_offset)) # Address from the binary #    io = gdb.debug(BIN, 'b main') # Stage 1 # Stage 2 # Stage 3