The solution for problem [input] of Toddler's Bottle from pwnable.

pwnable-toddlersbottle-input.py

#!/usr/bin/env python
# coding=utf8

'''
    Copy this file to /tmp, and run. That's all.
'''

import os
import socket
import random
import time

os.system('ln -s /home/input/flag ./')

random.seed(time.time())
port = random.randint(10000, 60000)
# stage 4
with open('\n', 'w') as f:
    f.write('\x00\x00\x00\x00')

r0, w0 = os.pipe()
r2, w2 = os.pipe()

pid = os.fork()
if pid == 0:
    os.close(w0)
    os.close(w2)
    os.dup2(r0, 0)
    os.dup2(r2, 2)
    # stage 3
    os.putenv('\xde\xad\xbe\xef', '\xca\xfe\xba\xbe')
    # stage 1 and the port for stage 5
    os.execv('/home/input/input',
             ['input'] + ['A'] * 64 + [''] + ['\x20\x0a\x0d'] +
             [str(port)] + ['A']*32)
else:
    os.close(r0)
    os.close(r2)
    wf0 = os.fdopen(w0, 'w')
    wf2 = os.fdopen(w2, 'w')
    # stage 2
    wf0.write('\x00\x0a\x00\xff')
    wf2.write('\x00\x0a\x02\xff')
    wf0.close()
    wf2.close()
    # stage 5
    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    time.sleep(1)  # wait for server
    client.connect(('127.0.0.1', port))
    client.send('\xde\xad\xbe\xef')
    client.close()
    print "Parent exits."