adr_shell.sh

#!/bin/sh

target_binary="$1"
system_addr=$(objdump -d "$target_binary" | \
    grep -E 'call.*<system@plt>' | \
    head -1 | \
    awk '{print $1}' | \
    sed -e 's/^.*<//' -e 's/>$//')
shell_addr=$(objdump -s "$target_binary" | \
    grep -E '/bin/sh' | \
    awk '{print $3}')
echo "System address:  $system_addr"
echo "Shell address:   $shell_addr"