Sone-127 2021 //top\\

The 7th argument on the stack points to the saved RIP of handle_echo .

Now we need a chunk that contains the string "/bin/sh" . The simplest way is to a file named sh.txt with that exact content. SONE-127 2021

The final crafted string (Python example): The 7th argument on the stack points to