Since there is no ASLR, it's possible for us to known the canary address(I use %18$p - 0xc0). Then we are able to fix canary.As a result, the fixed canary will call \_\_stack_check_fail.So my exp works as the following:1. hijack \_\_stack_check_fail@got to noxFlag2. fix canary3. the fixed canary will call \_\_stack_check_fail, which is noxFlag indeed.4. get flag
Here is my [exp](https://github.com/0x01f/pwn_repo/blob/master/noxCTF2018_believeMe/exp.py)