# ropfu
## DescriptionWhat's ROP?Can you exploit the following [program](https://artifacts.picoctf.net/c/271/vuln) to get the flag? [Download source](https://artifacts.picoctf.net/c/271/vuln.c).nc saturn.picoctf.net 50985
## solution
Like it said in the hint, this challenge is a classic ROP challenge.We can use *checksec* to see that NX is enabled, so we can't use shellcode or put anything on the stack for execute it.So we need to build a ROPchain that uses syscall to get a shell.
Lucky us we have a tool that can help us with that - ROPgadget.```ROPgadget --binary ./vuln --ropchain```This tool gives us the payload we need.And here the final program:
```#python2.7
from pwn import *from struct import packp='a'*28p += pack('