P1flyingring -

Run → get shell.

objdump -d p1flyingring | grep "jmp esp" → none in binary. Check libc or use push esp; ret : p1flyingring