Ddtek: Preview--------------The challenge presents us with the "preview" binary and the `libc.so.6` file.The binary allow us to view the first 7 lines of any file specified in theinput with the format "HEAD filename", if the file has less than 7 lines, itwill not be printed. That means the flag file is not accessible.
A quick look at the binary in ida, reveals us that the file is behaving likean unpacker, it loads ld.so.2 at a random address and makes it load the mainbinary in another random address. Furthermore we can see that the mainfunction has a clear stack overflow. But the binary has the canary...
Examining the unpacked behavior we see that the random position where thebinary loads are taken from the `AT_RANDOM` entry of the auxiliary vector. Soif we know where the program is loaded we leak also the canary, since theloader takes the canary value from the very same bytes.
After some thinking we found that the binary let's us read `/proc/self/maps`:BINGO! Fortunately the first seven entries printed match with the address ofthe binary and ld, that combined correspond with the canary. NowOVERFLOW+CANARY+PAD+ROPCHAIN_ON_LD gives us the desired shell!
```pythonfrom struct import packfrom pwn import *import base64import sysimport timeimport os
host = 'cee810fa.quals2018.oooverflow.io'port =  31337
def pow_hash(challenge, solution):    return hashlib.sha256(challenge.encode('ascii') + struct.pack('