Static binary without libc and nc flag set. Rop2win by setting registers ecx and edi to zero, ebx to /bin/sh address and eax to 0xb. The /bin/sh string is written into the name variable, therfore giving us a constant address to use.

Original writeup (https://github.com/coldBug/ctfwriteups/blob/master/tamuctf2018/pwn5.py).