http://bin.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/HTB/Easy/35.html
p.sendline(junk + bin_sh + pop_r13 + system + null + null + test)
p.interactive() Looking at the last 2 lines, first we trigger the buffer overflow, then place in the bin_sh variable into the rsp register,
then it is going to put the system memory location into r13, then going through the other 2 pops in that chain (with the 2 null bytes),
to then finally return to test, therefore test will now execute it. p.interactive() will hopefully allow us to have an interactive shell onto the system. λ root [...