Working Against a Remote Service

from pwn import *

# Toggle between local debugging and the real target:
context.binary = elf = ELF("./vuln")
libc = ELF("./libc.so.6")

if args.REMOTE:
    io = remote("ctf.example.edu", 1337)
else:
    io = process("./vuln")          # local, for testing the chain

# ... stage 1 leak, recompute libc.address, stage 2 ...
io.sendline(b"cat flag.txt")
io.interactive()

• Run python3 exploit.py REMOTE to hit the server; plain run to debug locally.
• Develop locally, then flip to remote() once the chain works.